CVE-2026-48863: libsolv Buffer Overflow Vulnerability

CVE-2026-48863 Overview

A stack-based buffer overflow vulnerability exists in libsolv, an open-source dependency solver library used by package managers such as zypper and dnf. The flaw resides in the PGP verification component (ext/solv_pgpvrfy.c), where incorrect length handling occurs when copying an EdDSA s Multi-Precision Integer (MPI) into a fixed-size stack buffer. A remote attacker can craft a malicious Ed25519 PGP signature with mismatched MPI lengths to trigger the overflow. Processing this signature disrupts automated package or repository verification workflows, resulting in denial of service. The vulnerability is tracked under [CWE-121: Stack-based Buffer Overflow].

Critical Impact
A crafted Ed25519 PGP signature can trigger a stack-based buffer overflow in libsolv, causing denial of service in automated package management and repository synchronization workflows.

Affected Products

libsolv (openSUSE upstream)
Red Hat Enterprise Linux distributions consuming libsolv
Package managers and tooling linking against libsolv PGP verification (e.g., zypper, dnf stacks that use libsolv's PGP verify path)

Discovery Timeline

2026-07-16 - CVE-2026-48863 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-48863

Vulnerability Analysis

The vulnerability originates in the Ed25519 signature verification path within solv_pgpvrfy. When libsolv parses a PGP signature packet containing EdDSA components, it extracts two MPIs representing the signature's r and s scalar values. Both scalars must be copied into a 64-byte sigdata stack buffer, right-aligned by their respective lengths. The routine uses rlen (the length of r) as the copy size for the s MPI instead of slen. When an attacker supplies a signature where rlen > slen, memcpy reads beyond the source buffer and writes past the destination's intended offset, corrupting the stack frame.

Root Cause

The defect is an incorrect variable reference in the memcpy invocation. The code passes rlen as the byte count when copying s, decoupling the copy length from the actual size of the s MPI. This violates the invariant that each MPI must be copied using its own length field, producing an out-of-bounds write bounded only by attacker-controlled length metadata in the malformed signature.

Attack Vector

Exploitation requires no authentication or user interaction. Any workflow that fetches and verifies PGP-signed repository metadata or package signatures using libsolv can process the malicious signature. Automated update pipelines, mirror synchronization jobs, and container image build systems are the most exposed attack surfaces because they consume remote signatures without human review.

// Patch from ext/solv_pgpvrfy.c - fixes wrong length variable in memcpy
 	if (rlen)
 	  memcpy(sigdata + 32 - rlen, r, rlen);
 	if (slen)
-	  memcpy(sigdata + 64 - slen, s, rlen);
+	  memcpy(sigdata + 64 - slen, s, slen);
 	res = mped25519(pub + 1 + 10 + 2 + 1, sigdata, sig + 2, hashl);
 	break;
       }
// Source: openSUSE/libsolv commit 44f8c085045b1f771641091bbb2b810d12cff9e8

Detection Methods for CVE-2026-48863

Indicators of Compromise

Unexpected crashes, aborts, or stack smashing messages from processes linking libsolv (for example zypper, dnf, PackageKit, or repository mirroring tools).
Repository synchronization or package installation jobs terminating during PGP signature verification of Ed25519-signed metadata.
Malformed Ed25519 PGP signature packets in repository metadata whose declared MPI lengths for r and s do not match the expected 32-byte scalar size.

Detection Strategies

Inventory hosts and container images that ship libsolv and correlate installed versions against fixed builds published by Red Hat and openSUSE.
Monitor process telemetry for abnormal termination of package management binaries during repository refresh or signature verification phases.
Inspect repository signature files for Ed25519 packets with mismatched r/s MPI length fields prior to consumption in automated pipelines.

Monitoring Recommendations

Enable core dump collection and crash reporting on build and update infrastructure to capture stack corruption evidence.
Alert on repeated failures of zypper refresh, dnf makecache, or equivalent operations tied to signature verification errors.
Track outbound connections from update systems to unexpected repository mirrors that could deliver crafted signature payloads.

How to Mitigate CVE-2026-48863

Immediate Actions Required

Apply the vendor-supplied libsolv update from your distribution as soon as it becomes available through Red Hat, openSUSE, or downstream package channels.
Restrict repository sources to trusted, authenticated mirrors and enforce HTTPS transport for metadata retrieval.
Rebuild and redeploy container images that embed vulnerable libsolv builds after patched packages are published.

Patch Information

The upstream fix is available in the openSUSE libsolv commit 44f8c085, which replaces the incorrect rlen argument with slen in the memcpy call inside solv_pgpvrfy. Distribution-specific advisories are tracked in the Red Hat CVE Advisory and the Red Hat Bug Report. Consult the Red Hat VEX Data for product status.

Workarounds

Disable Ed25519 PGP signature verification paths where configuration permits, falling back to RSA-signed metadata until patches are applied.
Isolate automated package management workflows behind a controlled internal mirror that pre-validates repository signatures before downstream consumers fetch them.
Limit privileges of processes performing repository refreshes so that a denial-of-service crash cannot cascade into dependent services.

bash

# Verify installed libsolv version and update on Red Hat-based systems
rpm -q libsolv
sudo dnf update libsolv

# Verify installed libsolv version and update on openSUSE-based systems
zypper info libsolv
sudo zypper refresh && sudo zypper update libsolv