The libsolv library, which resolves package dependencies using a satisfiability algorithm, contains a heap buffer overflow vulnerability (CVE-2026-48864) in its repopagestore functionality. This occurs due to unchecked decompression of specially crafted .solv page data, potentially allowing an attacker to cause memory corruption. Red Hat has issued a security advisory (RHSA-2026:36730) for Red Hat Enterprise Linux 8 and related products, rating the issue as moderate severity. The advisory provides updated libsolv packages that fix this vulnerability.

Successful exploitation of this heap buffer overflow could lead to arbitrary code execution or denial of service, impacting confidentiality, integrity, and availability of affected systems. The CVSS vector indicates local attack vector with low complexity, no privileges required, and user interaction needed, with high impact on all security objectives. However, no known exploits are reported in the wild at this time.

Red Hat has released updated libsolv packages for Red Hat Enterprise Linux 8 and related CodeReady Linux Builder variants that address this vulnerability. Users should apply the official security update as described in Red Hat advisory RHSA-2026:36730 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.