CVE-2026-82327

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

The vulnerable code path is the vertical/paged (lazily loaded) filelist decoder used by repo_write(), reached only when a consumer (e.g. dnf/libdnf) rewrites a .solv cache after having loaded one containing SOLVABLE_FILELIST data stored with KEY_STORAGE_VERTICAL_OFFSET. The out-of-bounds write always stores a fixed, non-attacker-controlled value, resulting in a crash (denial of service) rather than a confidentiality or integrity compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.