This advisory covers three security vulnerabilities in the libsolv library used in Red Hat Enterprise Linux 10 and Red Hat Hardened Images. The issues include: a stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150), a heap buffer overflow in repo_add_solv caused by a negative maxsize from a crafted .solv file (CVE-2026-9149), and a heap buffer overflow in repopagestore due to unchecked decompression of malicious .solv page data (CVE-2026-48864). These vulnerabilities could potentially lead to memory corruption. Red Hat has released updated libsolv packages (version 0.7.38-2.hum1) for multiple architectures including aarch64 and x86_64 to address these issues.

The vulnerabilities involve stack-based and heap buffer overflows in libsolv components, which could lead to memory corruption. The advisory rates the security impact as moderate. There are no known exploits in the wild. The affected products include Red Hat Enterprise Linux 10 and Red Hat Hardened Images across multiple architectures. Successful exploitation could affect package dependency resolution processes but specific exploitation scenarios are not detailed in the advisory.

Red Hat has released updated libsolv packages (version 0.7.38-2.hum1) that fix the identified buffer overflow vulnerabilities. Users of Red Hat Enterprise Linux 10 and Red Hat Hardened Images should apply these updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258 and https://images.redhat.com/. No additional mitigation steps are indicated by the vendor advisory.