A heap-based buffer overflow vulnerability exists in rpm when parsing a symlink entry in an untrusted RPM package with a crafted RPMTAG_LONGFILESIZES value. This causes an integer overflow that reduces a buffer allocation to one byte, enabling an attacker to write beyond the buffer using a controlled cpio filesize field. The flaw is exploitable via rpm2cpio, rpm2archive, and rpm -qlvp commands on untrusted packages. Red Hat has released updates to address this issue.