CVE-2026-9150 is a stack-based buffer overflow vulnerability in libsolv's Debian metadata parser. It occurs when specially crafted Debian repository metadata containing malicious SHA384 or SHA512 checksum tags is processed, causing memory corruption and potential denial of service. The flaw affects libsolv RPM packages included in Red Hat Hardened Images for aarch64 and x86_64 architectures. Exploitation requires a victim system to process untrusted Debian repository metadata. While the vulnerability can cause a crash or DoS, reliable code execution or system compromise has not been demonstrated. Red Hat classifies the impact as moderate and assigns a CVSS base score of 6.5 (medium).

The vulnerability can lead to denial of service due to a stack-based buffer overflow causing memory corruption when processing malicious Debian repository metadata. There is no evidence of reliable arbitrary code execution or system compromise. The flaw affects availability but not confidentiality or integrity. It requires processing untrusted metadata, which is not typical in default Red Hat configurations.

Red Hat advises ensuring that libsolv processes only trusted and cryptographically signed Debian repository metadata. Avoid ingesting or processing 'Packages' files from untrusted or unverified sources. No official patch or fix is currently provided in the advisory; patch status is not yet confirmed—check the vendor advisory for updates. Following the vendor's guidance to restrict metadata sources effectively mitigates the risk.