CVE-2026-48864: libsolv Buffer Overflow Vulnerability

CVE-2026-48864 Overview

CVE-2026-48864 is a heap buffer overflow vulnerability in libsolv, a library used by package managers including DNF and Zypper to resolve software dependencies. The flaw exists in the decompression routine that processes attacker-controlled compressed data inside .solv files. Insufficient input validation allows out-of-bounds memory access when a vulnerable application parses a crafted .solv file. Successful exploitation can result in information disclosure, alteration of program execution flow, or denial of service. The vulnerability is classified under CWE-787: Out-of-bounds Write.

Critical Impact

Processing a malicious .solv file can corrupt heap memory in any application linked against libsolv, potentially leading to local code execution in the context of the calling process.

Affected Products

• libsolv library (versions prior to the Red Hat fix in RHSA-2026:21333)
• Red Hat Enterprise Linux distributions shipping vulnerable libsolv packages
• Package management tooling that links against libsolv for repository metadata parsing

Discovery Timeline

• 2026-05-26 - CVE-2026-48864 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-48864

Vulnerability Analysis

The libsolv library uses binary .solv files as a cached, compressed representation of package repository metadata. During parsing, the library decompresses embedded data streams before deserializing dependency records. The decompression routine does not adequately validate length fields supplied within the compressed payload before writing the decompressed output to a heap-allocated buffer. When the declared or computed output size exceeds the allocated destination buffer, the routine writes past the buffer boundary, corrupting adjacent heap metadata and data structures.

This is a classic out-of-bounds write [CWE-787] triggered by attacker-controlled input. Because .solv files are consumed by package management tooling typically invoked with elevated privileges, heap corruption inside the parser can translate into integrity and confidentiality impact on the host.

Root Cause

The root cause is missing bounds enforcement between size fields embedded in the compressed .solv stream and the destination buffer allocated for decompression output. The parser trusts header-supplied lengths without cross-checking them against the actual buffer capacity or the remaining bytes in the input stream.

Attack Vector

The attack requires local access with user interaction: a victim must be induced to process a malicious .solv file using a vulnerable application. Distribution paths include compromised or attacker-controlled package repositories, untrusted repository mirrors, or .solv cache files dropped into directories consumed by package management tools. No authentication is required, but the attacker must convince the target application to read the crafted file.

No public proof-of-concept exploit code is currently available. Technical details are described in the Red Hat CVE-2026-48864 Overview and the Red Hat Bug Report #2460425.

Detection Methods for CVE-2026-48864

Indicators of Compromise

• Unexpected .solv files appearing in /var/cache/dnf/, /var/cache/zypp/, or other package manager cache directories from non-standard sources.
• Crashes or abnormal terminations of dnf, zypper, rpm, or PackageKit processes when reading repository metadata.
• Repository configurations pointing to unverified or untrusted mirrors that supply pre-built .solv cache files.

Detection Strategies

• Inspect process telemetry for segmentation faults or glibc heap corruption messages originating from binaries linked to libsolv.
• Audit repository configuration files such as /etc/yum.repos.d/*.repo and /etc/zypp/repos.d/*.repo for unauthorized changes or unknown sources.
• Validate .solv file integrity against known-good repository metadata before parsing in automated pipelines.

Monitoring Recommendations

• Enable system-level crash reporting (abrt, systemd-coredump) to capture stack traces from package manager processes.
• Forward package manager and kernel logs to a centralized logging platform and alert on repeated crashes of libsolv-linked processes.
• Track file creation events for .solv files written outside of authorized package manager update workflows.

How to Mitigate CVE-2026-48864

Immediate Actions Required

• Apply the updated libsolv packages distributed in Red Hat Security Errata RHSA-2026:21333 on all affected Red Hat Enterprise Linux systems.
• Restrict package manager configurations to trusted, signed repositories and disable any third-party mirrors that cannot be verified.
• Audit running systems for processes and containers that link against libsolv and prioritize patching those workloads.

Patch Information

Red Hat has released fixed libsolv packages through RHSA-2026:21333. Administrators should update using the standard distribution package manager and restart services or rebuild container images that bundle the vulnerable library. Refer to the Red Hat CVE-2026-48864 advisory for the complete list of fixed package versions per RHEL stream.

Workarounds

• Avoid running package management operations against untrusted repositories until patches are applied.
• Remove or quarantine cached .solv files from unknown origins under /var/cache/dnf/ and /var/cache/zypp/ and force regeneration from trusted repository metadata.
• Limit local user access on multi-tenant systems where unprivileged users could stage malicious .solv files for privileged consumers.

# Update libsolv on Red Hat Enterprise Linux
sudo dnf clean all
sudo dnf update libsolv
rpm -q libsolv

# Clear potentially tainted solv caches
sudo rm -f /var/cache/dnf/*/*.solv /var/cache/dnf/*/*.solvx
sudo dnf makecache