CVE-2026-103242

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

This issue is rated Moderate because, while parsing a crafted RPM triggers an attacker-controlled-content, attacker-controlled-length heap write, exploitation is local: a user or automated workflow must choose to run rpm -qlvp, rpm2cpio, or rpm2archive against the untrusted package. The flaw is not exposed as a network service. Testing against the shipped rpm binary demonstrated a reliable crash; no proof-of-concept achieving code execution beyond the crash has been produced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid processing or extracting RPM packages from untrusted or unsigned sources. Do not run rpm -qlvp, rpm2cpio, or rpm2archive against RPM files whose origin and integrity cannot be verified.