A heap-based buffer overflow was identified in the rpm package parser used in Red Hat Enterprise Linux 10. The vulnerability arises when parsing a symlink entry in an untrusted RPM package whose RPMTAG_LONGFILESIZES value is set to 0xFFFFFFFFFFFFFFFF. This triggers an integer overflow in the iterReadArchiveNext() function, shrinking the buffer allocation to a single byte. Subsequently, the cpio filesize field, controlled by the attacker, is used to write data beyond the allocated buffer, causing a heap overflow. This flaw can be exploited locally by running rpm2cpio, rpm2archive, or rpm -qlvp on crafted untrusted RPM packages. The flaw is not exposed via network services and requires user interaction to trigger. Red Hat classifies the issue as Moderate due to the local and user-involved nature of exploitation, despite the high CVSS score reflecting potential integrity and availability impacts.

Successful exploitation can lead to heap-based buffer overflow, allowing an attacker to write beyond allocated memory. This can result in modification of memory, potentially leading to unauthorized code execution or commands, and denial of service through crashes or restarts. The vulnerability affects integrity and availability but does not impact confidentiality. Exploitation is local and requires user interaction to process a crafted RPM package.

Red Hat advises avoiding processing or extracting RPM packages from untrusted sources. Specifically, do not use rpm2cpio, rpm2archive, or rpm -qlvp on RPM files whose origin and integrity cannot be verified. No official patch or fix is currently confirmed; therefore, users should rely on these mitigations until a vendor fix is released. Check the Red Hat advisory for updates on patch availability.