USN-9076-1: libsolv vulnerability

Q: What does an attacker need to exploit this issue?

An attacker would need to provide specially crafted repository data that triggers the incorrect handling and heap-based buffer over-read in libsolv.

Q: What is the practical impact of successful exploitation?

Successful exploitation may cause libsolv to crash, resulting in a denial of service.

Published Nov 12, 2026

Updated

It was discovered that libsolv incorrectly handled certain repository data, leading to a heap-based buffer over-read. An attacker could possibly use this issue to cause libsolv to crash, resulting in a denial of service.

Affected Software

2 affected componentsFixes available

ubuntu/libsolv<0.6.11-1.1ubuntu0.1~esm1

0.6.11-1.1ubuntu0.1~esm1

ubuntu/libsolv<0.6.30-1ubuntu0.1~esm2

0.6.30-1ubuntu0.1~esm2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libsolv to a version that resolves this vulnerability.
Fixed in 0.6.11-1.1ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/libsolv to a version that resolves this vulnerability.
Fixed in 0.6.30-1ubuntu0.1~esm2

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker would need to provide specially crafted repository data that triggers the incorrect handling and heap-based buffer over-read in libsolv.

What is the practical impact of successful exploitation?

Successful exploitation may cause libsolv to crash, resulting in a denial of service.

USN-9076-1: libsolv vulnerability

Affected Software

Remediation

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?