Description

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-28T16:18:34.067Z",
  "pubdate": "2026-08-28T16:18:34.067Z",
  "executiveSummary": "A critical memory safety vulnerability exists in libsolv, a dependency-resolution library utilized by package managers including dnf, yum, and zypper.\nThe vulnerability is characterized as an out-of-bounds memory write occurring during the parsing of .solv repository cache files.\nThe flaw stems from a lack of input validation when processing directory-id values embedded within compressed filelist data.\nExploitation requires the presence of a corrupted or maliciously crafted .solv cache file on the target system.\nThe primary impact of this vulnerability is a Denial of Service (DoS) resulting from the termination of the package management process.\nWhile the vulnerability facilitates out-of-bounds memory access, exploitation is limited to writing a fixed, non-attacker-controlled value, which significantly lowers the risk of remote code execution.\nThe risk is primarily localized, as it requires an attacker to successfully place or manipulate files on the filesystem, or rely on system-level file corruption caused by events such as an unclean system shutdown.",
  "technicalDetails": "The vulnerability resides within the libsolv library's logic for parsing and rewriting .solv repository cache files. Specifically, the flaw is triggered during the decompression and extraction phase of the filelist data.\nRoot Cause: The library fails to perform bounds checking on directory-id integers retrieved from the cache file's internal data structures. Because these identifiers are trusted implicitly during the cache-processing workflow, an improperly constrained index can reference memory outside of the intended array boundaries.\nAttack Flow: When a package manager (e.g., dnf or zypper) invokes libsolv to process a .solv file, the library maps the stored filelist data into its internal structures. If the cache file is corrupted—whether through a torn write during a power failure or deliberate tampering—the directory-id fields may contain values exceeding the expected range for the associated data arrays. Upon accessing these out-of-bounds addresses, the library attempts to perform a write operation using a fixed, static value.\nPayload Behavior: The vulnerability manifests as an out-of-bounds write primitive. However, because the value being written to the out-of-bounds memory location is constant and not under the control of an attacker, the capability to influence program flow to achieve arbitrary code execution is effectively negated.\nExploitation Constraints: Successful exploitation leads to an illegal memory access or an inconsistent application state, triggering a crash of the host process (e.g., the package manager). The attack does not require network exposure, as it relies on local file access. There are no authentication or privilege requirements to trigger the crash if the attacker can influence the state of the repository cache directory, although standard filesystem permissions typically protect these locations.\nComponent and Versioning: The vulnerable component is the libsolv library. Any tool that relies on libsolv to parse repository metadata is potentially susceptible if it processes untrusted or corrupted .solv files. The impact is strictly confined to local denial of service via process termination due to memory access violations."
}