CVE-2026-44605: Rpm: heap buffer overflow in ndb slot table parsing
A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.
Other sources
A heap buffer overflow exists in RPM's NDB database backend (lib/backend/ndb/rpmpkg.c) due to unchecked 32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-disk NDB header and used in a 32-bit multiplication (slotnpages (PAGESIZE / SLOTSIZE)) to size a heap allocation. A crafted Packages.db can supply a slotnpages value that wraps this product to a small number, causing xcalloc to allocate an undersized buffer. The subsequent loop iterates over the full unwrapped page count, writing pkgslot entries past the heap boundary before per-slot validation runs. Exploitation requires the victim to open a crafted NDB database file with RPM tooling, and NDB is not the default backend in Fedora or RHEL (both default to sqlite).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44605?
The severity of CVE-2026-44605 is medium with a score of 5.5.
How do I fix CVE-2026-44605?
To fix CVE-2026-44605, update your RPM Package Manager to the latest patch that addresses this vulnerability.
What type of vulnerability is CVE-2026-44605?
CVE-2026-44605 is a heap buffer overflow vulnerability found in the parsing of NDB database files by RPM.
Who can exploit CVE-2026-44605?
A local user can exploit CVE-2026-44605 when processing a specially crafted NDB database file.
What impact does CVE-2026-44605 have on affected systems?
CVE-2026-44605 can lead to a denial of service due to a heap buffer overflow.