CVE-2026-48863: Opensuse Libsolv

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

Affected products

• Opensuse Libsolv: from 0.6.4, before 0.7.38 (fixed in 0.7.38)
• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Hardened Images
• Red Hat Red Hat Openshift Container Platform 4
• Red Hat Red Hat Satellite 6
• Red Hat Red Hat Update Infrastructure 4 For Cloud Providers

Published 2026-07-16. Last modified 2026-08-31.