A heap-based buffer overflow vulnerability exists in rpm due to incorrect header type declaration of RPMTAG_FILESIGNATURES in crafted unsigned RPM packages. This causes a one-byte buffer allocation followed by an out-of-bounds write of attacker-controlled data. The flaw is exploitable via rpm2cpio, rpm2archive, and rpm -qlvp commands on untrusted packages. The vulnerability has a CVSS score of 7.1, indicating medium severity.