A crafted RPM file can trigger a Rust panic in the OpenPGP signature parsing code (librpmsequoia) during RPM signature verification. The panic crosses the Rust/C FFI boundary and causes an unconditional abort of the rpm process, resulting in a denial of service. The issue is reachable via standard RPM CLI operations such as rpm -Kv and rpm --checksig without installing the package.

An attacker only needs to supply a specially crafted RPM file to a victim system where the RPM file is processed for signature verification (e.g., rpm -Kv, rpm --checksig, CI pipelines, or automated package validation workflows). No privileges, user interaction, or package installation are required.