CVE-2026-2625 is a vulnerability in rust-rpm-sequoia affecting Red Hat Hardened Images RPMs. The issue arises during the OpenPGP signature verification of RPM files, where a specially crafted RPM triggers a Rust panic, causing the rpm process to abort. This leads to an application-level denial of service, disrupting RPM signature verification functionality. The vulnerability can be exploited locally without privileges or user interaction by processing malicious RPM files. The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). Red Hat has published an advisory (RHSA-2026:12682) describing the issue and recommending mitigation steps but has not yet released a patch.

The vulnerability causes an application-level denial of service by terminating the rpm process during signature verification of RPM files. This prevents the system from verifying RPM signatures, potentially disrupting package management operations that rely on signature checks. There is no impact on confidentiality or integrity, and no privilege escalation is involved. Exploitation requires local access to process RPM files but no special privileges or user interaction.

Red Hat has not yet released a patch or official fix for this vulnerability. Users should avoid processing untrusted or attacker-controlled RPM files with rpm -Kv or rpm --checksig. It is recommended to use isolated environments or additional validation layers when handling untrusted RPM artifacts to mitigate the risk. Monitor Red Hat advisories for updates regarding an official fix.