rpm: Heap-based buffer overflow in hex2binv() via crafted RPM package
Summary
A heap-based buffer overflow in the RPM Package Manager allows a crafted, unsigned RPM package to write attacker-controlled data past a heap allocation. The flaw is triggered when a user or automated job runs rpm -qlvp, rpm2cpio or rpm2archive against the untrusted package. Red Hat reports a reliable crash, but code execution has not been demonstrated, and the flaw is not exposed as a network service.
Affected
- Red Hat Enterprise Linux 8, 9 and 10 (Red Hat rates these as affected; RHEL 10 is listed as affected by default)
- Red Hat Hardened Images (affected)
- RHEL 6 and 7: unaffected by default
- Other distributions: Debian and Ubuntu list rpm as vulnerable or under evaluation; exact versions unknown.
- Azure Linux OSV tracks the issue against rpm 4.18.2-2.
Fixed in
Unknown. No fixed version or vendor erratum has been published at the time of this entry.
Workaround
- Avoid processing or extracting RPM packages from untrusted or unsigned sources.
- Do not run rpm -qlvp, rpm2cpio or rpm2archive against RPM files whose origin and integrity cannot be verified.
- Check package signatures before inspection.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Red Hat: no proof-of-concept achieving code execution beyond the crash has been produced.
- EPSS 0.00119 (Vulners).
Our recommendation
- Track the Red Hat CVE page and install rpm updates for your distribution as soon as they are released.
- Until a fix is available, restrict inspection of unsigned or third-party RPM packages to sandboxed or throwaway hosts.
- Check CI/CD pipelines, build servers and repository scanners, which are the most exposed.
- Monitor the vendor advisories for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-103242 access.redhat.com
- Red Hat Bugzilla 2543866 bugzilla.redhat.com
- Debian security tracker rpm security-tracker.debian.org
- Ubuntu CVE-2026-103242 ubuntu.com
- Vulners OSV AZL-105810 vulners.com
- Vulners PT-2026-109678 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 21:08.
Original description (NVD)
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.