This vulnerability in libsolv involves a heap buffer overflow triggered by processing specially crafted .solv files containing compressed data. The flaw arises from inadequate validation of input data during decompression, which allows an attacker to cause out-of-bounds memory writes. This can compromise confidentiality, integrity, and availability of affected systems running Red Hat Enterprise Linux 10. The CVSS 3.1 base score is 7.8, reflecting high impact with local attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to information disclosure, unauthorized modification of program execution flow, or denial of service conditions on affected systems. The vulnerability affects local users who can supply malicious .solv files to vulnerable applications. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-48864 for current remediation guidance. Until an official fix is available, avoid processing untrusted .solv files or restrict access to components that handle such files. Follow vendor updates closely for patches or workarounds.