A heap buffer overflow vulnerability exists in libsolv's decompression of .solv files caused by insufficient input validation of attacker-controlled compressed data. This out-of-bounds write can be triggered by processing a maliciously crafted .solv file, potentially resulting in information disclosure, arbitrary code execution, or denial of service. The issue affects Red Hat Enterprise Linux 10 versions >=10.0.0 and <10.2. Red Hat has issued security advisories and released updated libsolv packages (version 0.7.38-2.hum1 and 0.7.33-5.el10_2) that fix this vulnerability along with related libsolv flaws. The CVSS v3.1 score is 7.8 (High severity) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Successful exploitation of this vulnerability can lead to out-of-bounds memory access resulting in information disclosure, alteration of program execution flow, or denial of service conditions. The vulnerability requires local access (AV:L) and user interaction (UI:R) but does not require privileges (PR:N). The impact on confidentiality, integrity, and availability is high.

Red Hat has released updated libsolv packages that address this vulnerability. Users should apply the security updates for libsolv as provided in Red Hat Enterprise Linux 10.2 and later. Details and update instructions are available in the Red Hat advisories RHSA-2026:21333 and RHSA-2026:28236. Patch status is confirmed by the vendor advisory. No additional mitigation is required once the update is applied.