CVE-2026-44605

A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

This vulnerability has a Low impact on Red Hat Enterprise Linux and Fedora systems. A heap buffer overflow in RPM's NDB database backend can be triggered by processing a specially crafted NDB database file. However, NDB is not the default RPM database backend in these distributions, which instead utilize SQLite, significantly reducing the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.