CVE-2026-48864

Name	CVE-2026-48864
Description	A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsolv (PTS)	bullseye	0.7.17-1+deb11u1	vulnerable
	bookworm	0.7.23-1+deb12u1	vulnerable
	trixie	0.7.32-1	vulnerable
	forky, sid	0.7.39-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsolv	source	(unstable)	(unfixed)	unimportant

https://bugzilla.redhat.com/show_bug.cgi?id=2460425
Not considered a security risk per upstream, as issue is in solv file parser