CVE-2026-92824

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

This Moderate flaw is a heap-based out-of-bounds read with established denial-of-service impact. Exploitation requires parsing crafted modulemd v2 input that includes artifacts.rpm-map with multiple digest algorithms, then serializing the resulting object. Confidentiality, integrity, and code-execution impact were not established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a fixed package is available, avoid round-tripping untrusted modulemd v2 documents that include artifacts.rpm-map. If untrusted metadata must be accepted, reject or strip rpm-map content with multiple digest algorithms before serializing the parsed object.