PT-2026-43313 · Libsolv · Libsolv

Found By · Published 2026-05-26 · Updated 2026-07-09 · CVE-2026-48864

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libsolv (affected versions not specified)

Description A heap buffer overflow occurs during the decompression of attacker-controlled compressed data within .solv files due to insufficient input validation. An attacker can provide a specially crafted .solv file that, when processed by a vulnerable application, leads to out-of-bounds memory access. This may result in information disclosure, alteration of program execution, or a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2026:28236

ALSA-2026:36730

CVE-2026-48864

RHSA-2026:21333

RHSA-2026:28236

Affected Products

Libsolv

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48864.json · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=2460425 · Exploit
• https://osv.dev/vulnerability/ALSA-2026:36730 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48864 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:28236 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:28236 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48864 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48864 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48864 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48864 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:36730 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-28236.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48864 · Security Note
• https://errata.almalinux.org/8/ALSA-2026-36730.html · Vendor Advisory