CVE-2026-48863 Details
Description
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.
A stack-based buffer overflow vulnerability has been identified in the libsolv library, specifically within the PGP verification component. This vulnerability arises from improper length handling when copying the EdDSA 's' MPI into a stack buffer. A remote attacker could exploit this flaw by crafting a malicious Ed25519 PGP signature with mismatched MPI lengths. When this signature is processed, it could lead to a denial-of-service condition in automated package or repository processing workflows.
Users should update to libsolv version 0.7.38 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | redhat-SADP |
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 31, 2026 | CVE Modified | redhat-SADP |
| Aug 31, 2026 | CVE Modified | [email protected] |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 21, 2026 | CVE Modified | [email protected] |
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 16, 2026 | New CVE Received | [email protected] |