CVE-2026-25707VulnerabilityPublished 23 Jun 2026Updated 29 Oct 2026

SUSE libzypp · Security update for libsolv, libzypp, zypper

Affects SUSE libzyppSource GCVE Database

Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : patch the affected SUSE packages soon.

Data as of 6 Nov 2026, 23:24 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 48% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 17.38.13, 0.7.39

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade the SUSE to 17.38.13 (suse/libzypp package) or 0.7.39 (suse/libsolv package).

Affected software

Product	Affected	Fixed in
SUSEsuse/libzypp`pkg:rpm/suse/libzypp`Other threats	Affected <17.38.13	Fixed in 17.38.13
SUSEsuse/libsolv`pkg:rpm/suse/libsolv`Other threats	Affected <0.7.39	Fixed in 0.7.39

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

An official security update is available that addresses all listed vulnerabilities. Users should apply the update to libsolv, libzypp, and zypper as provided by the SUSE Product Security Team. The update enforces path restrictions, sanitizes repository metadata, and fixes buffer overflow conditions. No additional mitigation steps are required beyond applying the official update.

Description

This update for zypper, libzypp, libsolv fixes the following issues: Changes in zypper: Update to 1.14.98: - Transactional systems: Delegate rw-commands to transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607) On a transactional system where the root filesystem is mounted read-only, zypper commands that modify the system cannot be executed directly. If the system provides a transactional-wrapper utility, zypper will automatically attempt to invoke it. The wrapper transparently executes the zypper command within a new, writable snapshot and manages the lifecycle of that snapshot based on the command's exit status. On transactional systems lacking a transactional-wrapper, users must manually invoke specialized tools -such as transactional-update- to install, update, or remove software. - Add --filter-version-change to zypper lu. Adds filtering by version change significance to reduce noise in update listings. Supports levels: rebuild (hides rebuild-only changes) and package (hides all release-only changes). - Autorefresh ris-services the way as plugin-services (bsc#1246504) It's actually wrong to treat service refreshes different depending on the service type. For the purpose of a service it makes no difference how the data about the repos to use are acquired. Changes in libzypp: Updated to 17.38.13: - A .repo files "path=" entry must not refer to a location outside the repo (bsc#1267874, CVE-2026-44942) A "path=" entry may solely denote a sub-directory of the baseurl where the metadata are located. A relative path trying to access data outside the baseurl is reported and sanitized. - Repo "keyhint" must denote a filename, no path (bsc#1267426, CVE-2026-44941) - Fix potential crash on malformed or malicious repository metadata (fixes #740) - Repo metadata: discard entries referring to a location outside the repo (bsc#1259802, CVE-2026-25707) Mirroring those data locally would refer to a location outside the repo's local cache directory. Those data entries are reported and discarded. - zypp.conf: Allow [env] section to add environment variables. This feature is designed to enable environment-specific settings or debugging options over an extended period. See zypp.conf(5). - Prevent configured scripts from escaping the sigcheck directory (bsc#1265223, CVE-2026-44933) - StringV: guard hasPrefix/hasPrefixCI against reading past the view end (fixes #735) - Mandatory signature verification plugin support (PED#11922) - Fix purge-kernel -rc kernel handling (bsc#1239718) - Explicitly_set_pool_DISTTYPE_RPM (fixes #726) - Check for trusted key updates when updating the general keyring (bsc#1259706) - Support multiple MirroredOrigin authorities (bsc#1253193) - Workaround doxygen bug: doxygen/doxygen#12057 - libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842) Changes in libsolv: Updated to 0.7.39: - fix solv_chksum_free segfault when called with a NULL pointer - made repo_add_solv more robust against corrupt files [bsc#1265935] [CVE-2026-9149] - fix potential buffer overflow when verifying EdDSA signatures [bsc#1266039] [CVE-2026-48863] - added limit checks in multiple places to catch overflows - reduce the size of the language id cache - fixed Debian canon selection - fixed dbpath detection in repo_rpmdb_librpm - reduced stack usage in repo page compression (needed for musl) - fix parsing of sha512 checksums in debian repositories [bsc#1265938] [CVE-2026-9150] - improve speed of dirpool_add_dir makeing parsing of filelists.xml twice as fast - fix parsing of recommends in the old Mandriva synthesis format

Impact

Exploitation of these vulnerabilities could lead to memory corruption (heap and stack buffer overflows), application crashes, and unauthorized overwriting of local files. Path traversal issues could allow attackers to access or modify files outside intended directories. These vulnerabilities affect the integrity and stability of package management operations, potentially enabling local attackers to compromise system security or disrupt package management processes.

Summary

The update for libsolv, libzypp, and zypper resolves seven distinct vulnerabilities: CVE-2026-9149 (heap buffer overflow via negative maxsize in .solv files), CVE-2026-9150 (stack buffer overflow in Debian metadata parser handling SHA384/SHA512 checksums), CVE-2026-25707 (arbitrary local file overwrite via crafted repo metadata), CVE-2026-44933 (prevention of script escape from signature verification directory), CVE-2026-44941 and CVE-2026-44942 (path traversal via 'keyhint' and .repo file path entries), and CVE-2026-48863 (buffer overflow parsing EdDSA signatures). The libzypp component was updated to version 17.38.13 with enhanced validation to disallow repo paths outside the base URL and discard metadata entries that would reference locations outside the local cache. libsolv was updated to version 0.7.39 with improved robustness against corrupt files and added limit checks to prevent overflows. These changes collectively improve security by preventing memory corruption, unauthorized file writes, and path traversal attacks in repository handling.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Jun 2026, 17:22 UTC

Technical details

References

Community reviews

Related threats