A heap buffer overflow vulnerability exists in libsolv's repo_add_solv function due to improper handling of negative size values in specially crafted .solv files. This leads to undersized memory allocation and subsequent out-of-bounds writes. The vulnerability affects Red Hat Enterprise Linux 10 versions >=10 and <10.2. Red Hat has released security advisories (RHSA-2026:21333 and RHSA-2026:28236) providing updated libsolv packages (version 0.7.33-5.el10_2 and later) that fix this issue. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) and can result in denial of service but does not impact confidentiality or integrity. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can cause a denial of service (DoS) by triggering a heap-based buffer overflow in the libsolv library when processing malicious .solv files. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability does not require privileges and can be triggered remotely with user interaction.

Red Hat has released official security updates for libsolv that address this vulnerability. Users of Red Hat Enterprise Linux 10 versions >=10 and <10.2 should apply the libsolv package updates provided in advisories RHSA-2026:21333 and RHSA-2026:28236. The updated packages include libsolv-0.7.33-5.el10_2 and related components. Applying these updates will remediate the vulnerability. Refer to Red Hat's official advisories and update instructions at https://access.redhat.com/security/cve/CVE-2026-9149 and https://access.redhat.com/errata/RHSA-2026:28236 for detailed guidance.