CVE-2026-82327: Improper Validation of Array Index in Red Hat Red Hat Enterprise Linux 10

The vulnerability in libsolv arises when it rewrites a .solv cache file and reads directory-id values from compressed filelist data without validating their range. If the .solv cache file is corrupted or specially crafted (e.g., left in a torn state after an unclean shutdown), processing it with tools like dnf, yum, or zypper can trigger an out-of-bounds memory write. This write always stores a fixed constant rather than attacker-controlled data, causing the tool to crash (denial of service) but not enabling code execution or data compromise. The vulnerable code path is specifically the vertical/paged filelist decoder used during rewriting of .solv caches containing SOLVABLE_FILELIST data with KEY_STORAGE_VERTICAL_OFFSET. Red Hat has not provided a patch or mitigation at this time.

Successful exploitation causes a denial of service by crashing affected package management tools (dnf, yum, zypper) when processing corrupted or specially crafted .solv cache files. There is no impact on confidentiality or integrity, and arbitrary code execution is not expected due to the fixed value written out-of-bounds.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and patches addressing this issue.