The libsolv library, which resolves package dependencies using a satisfiability algorithm, contains three distinct buffer overflow vulnerabilities. CVE-2026-9150 is a stack-based buffer overflow in the Debian metadata parser when processing SHA384/SHA512 checksums. CVE-2026-9149 is a heap buffer overflow in the repo_add_solv function caused by a negative maxsize value from a crafted .solv file. CVE-2026-48864 is another heap buffer overflow in repopagestore due to unchecked decompression of malicious .solv page data. These vulnerabilities have been assigned a moderate security impact by Red Hat Product Security and affect Red Hat Enterprise Linux 10 and its variants. Updated packages have been released to fix these issues as detailed in Red Hat advisory RHSA-2026:28236.

Successful exploitation of these vulnerabilities could result in denial of service or potential memory corruption issues within the libsolv library. The CVSS vector for CVE-2026-9149 indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. No known exploits are reported in the wild. The vulnerabilities affect package dependency resolution processes, which could disrupt system operations if exploited.

Red Hat has released updated libsolv packages for Red Hat Enterprise Linux 10 and related products that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:28236 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified by the vendor. Patch status is confirmed by the vendor advisory.