CVE-2026-44605: RPM Package Manager Buffer Overflow Flaw

CVE-2026-44605 Overview

CVE-2026-44605 is a heap buffer overflow vulnerability in the RPM Package Manager (RPM) that affects local users processing a specially crafted New Database (NDB) file. The flaw resides in RPM's file parsing logic, where an incorrect calculation leads to an undersized memory allocation. Processing the crafted NDB database file then writes beyond the allocated heap buffer. Successful exploitation causes a denial of service by crashing the RPM process and making package management operations unavailable. The vulnerability is tracked under CWE-190: Integer Overflow or Wraparound and requires local access and user interaction.

Critical Impact
A local attacker can trigger a heap buffer overflow in RPM by supplying a crafted NDB database file, causing denial of service against package management operations.

Affected Products

RPM Package Manager (RPM) — NDB database backend
Red Hat Enterprise Linux distributions shipping the affected RPM build (see Red Hat CVE-2026-44605)
Downstream distributions consuming the vulnerable RPM package parser

Discovery Timeline

2026-08-05 - CVE-2026-44605 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-44605

Vulnerability Analysis

RPM's NDB backend is a database format used to store package metadata on disk. When RPM parses an NDB file, it performs size calculations to allocate a heap buffer that will hold record data read from the file. The vulnerability stems from an error in one of these calculations. The result is a buffer allocation that is too small for the data RPM subsequently writes into it, producing a heap buffer overflow.

The overflow condition maps to [CWE-190], an integer overflow or wraparound during arithmetic on untrusted length or offset values from the NDB file. Because the miscalculated value is used directly for allocation sizing, the parser trusts an attacker-controlled input to determine memory bounds. Corruption of adjacent heap metadata typically causes librpm to abort, halting the running RPM operation.

Exploitation requires that a local user be induced to process the crafted NDB file, which aligns with the required user interaction. Impact is limited to availability; confidentiality and integrity of system data are not affected according to the advisory.

Root Cause

The root cause is an arithmetic error during NDB record size computation. Attacker-supplied fields in the NDB file lead to an integer overflow or an otherwise incorrect result, which is then passed to the heap allocator. Subsequent copy operations exceed the actual buffer length, corrupting adjacent heap memory.

Attack Vector

The attack vector is local. An attacker places a malicious NDB database file where a local user or automated tool will invoke RPM against it. When RPM parses the file, the miscalculated allocation is triggered and the overflow crashes the process. The attacker does not need prior authentication, but the victim must interact with or process the crafted file. See the Red Hat Bug Report #2482481 for parser-level details.

No verified public exploit code is available for CVE-2026-44605. Refer to the Red Hat Security Errata RHSA-2026:33507 for the authoritative technical description.

Detection Methods for CVE-2026-44605

Indicators of Compromise

Unexpected crashes of rpm, rpmdb, or librpm-linked tooling when reading a specific NDB file
Core dumps or SIGABRT events referencing heap corruption in RPM parsing routines
Presence of unfamiliar or externally sourced NDB database files outside /var/lib/rpm/
Audit records showing RPM invocations on database files supplied through user-writable paths

Detection Strategies

Monitor process termination and core-dump events for rpm and related binaries via auditd or systemd-coredump logs
Alert on RPM invocations that reference NDB files outside the trusted system database directory
Track installed RPM package versions against the fixed release listed in RHSA-2026:33507

Monitoring Recommendations

Forward auditd, journald, and coredump telemetry to a centralized log platform for correlation
Baseline normal RPM execution paths so anomalous invocations against user-supplied NDB files stand out
Include RPM package version in host inventory scans to identify unpatched systems

How to Mitigate CVE-2026-44605

Immediate Actions Required

Apply the vendor-provided RPM update referenced in RHSA-2026:33507 as soon as it is available for your distribution
Inventory hosts running affected RPM builds and prioritize multi-user and shared build systems
Restrict write access to directories from which RPM reads NDB database files

Patch Information

Red Hat has published errata RHSA-2026:33507 addressing CVE-2026-44605. Consult the Red Hat CVE page for the fixed package versions across supported Red Hat Enterprise Linux releases. Downstream distributions should ship equivalent updates; verify with your vendor advisories before deployment.

Workarounds

Avoid invoking rpm against NDB database files received from untrusted sources or user-writable locations
Enforce strict filesystem permissions on /var/lib/rpm/ and any custom RPM database paths so only trusted administrators can modify them
Where feasible, use the BerkeleyDB or SQLite RPM backends instead of NDB until the patch is applied, following distribution guidance

bash

# Verify installed RPM version and apply the vendor update
rpm -q rpm
sudo dnf update rpm --refresh
# Confirm the fixed version after patching
rpm -q --changelog rpm | head -n 20