Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

cve-program · CVE-2026-9149

Published

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

Read the publisher's advisory

Affected versions, risk and source history

Related advisories and sources

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-9149 · CVE overview and exploitation status

cve-program · CVE-2026-9149

Related changes

Linked by CVE identifier
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 23:13 UTC · 274 of 275 readable · 250 fully read · 18 waiting for GitHub's hourly limit · documentation 461/469 current