MGASA-2026-0569: Updated libsolv package fixes security vulnerabilities
Stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service. (CVE-2026-48863) Heap buffer overflow in libsolv repoaddsolv via negative maxsize from crafted .solv file. (CVE-2026-9149) Stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums. (CVE-2026-9150)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/libsolvto a version that resolves this vulnerability.Fixed in 0.7.39-1.mga10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What attacker-controlled inputs can trigger these flaws?
The issues can be triggered while libsolv verifies an EdDSA PGP signature, processes a crafted .solv file, or parses Debian metadata containing SHA-384 or SHA-512 checksums.
What impact is explicitly documented?
The EdDSA PGP signature verification stack overflow is documented as allowing denial of service. The provided advisory data identifies buffer overflows in the other affected parsing paths but does not state a specific impact for them.