Threats affecting pkg:rpm/redhat/libsolv

A heap buffer overflow vulnerability exists in the libsolv library used for resolving package dependencies, triggered by unchecked decompression of malicious .solv page data. This flaw is identified as CVE-2026-48864 and has been rated with moderate security impact by Red Hat. The vulnerability affects Red Hat Enterprise Linux 8.8 variants and related update services. Red Hat has issued security updates to address this issue.

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150) * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.