CVE-2026-44605 is a heap buffer overflow vulnerability in the RPM Package Manager's NDB database backend caused by an integer overflow or wraparound during file parsing. This results in incorrect memory allocation, which can be triggered by processing a maliciously crafted NDB database file. The vulnerability can cause a denial of service by crashing the system. Red Hat notes that the default RPM backend in their distributions is SQLite, not NDB, which significantly limits exposure. The issue affects multiple RPM-related packages in Red Hat Hardened Images and has been addressed in version 6.0.1-6.2.hum1 of these packages.

The vulnerability can cause a denial of service (system crash or unavailability) when a local user processes a specially crafted NDB database file with RPM. There is no impact on confidentiality or integrity. The attack complexity is low and no privileges are required, but user interaction is needed. The overall impact on Red Hat Enterprise Linux and Fedora is low due to the non-default use of the NDB backend, reducing the attack surface.

A security update is available from Red Hat that addresses this vulnerability in multiple RPM packages (version 6.0.1-6.2.hum1). Users of Red Hat Hardened Images should apply this update promptly. Since the vulnerability is in the NDB backend, which is not the default, the risk is reduced. No additional mitigations are specified by Red Hat.