Advisories » MGASA-2026-0569

Updated libsolv package fixes security vulnerabilities

Publication date: 30 Oct 2026
Modification date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48863 , CVE-2026-9149 , CVE-2026-9150

Description

Stack-based buffer overflow in libsolv eddsa pgp signature verification
allows denial of service. (CVE-2026-48863)
Heap buffer overflow in libsolv repo_add_solv via negative maxsize from
crafted .solv file. (CVE-2026-9149)
Stack-based buffer overflow in libsolv's debian metadata parser when
handling sha384/sha512 checksums. (CVE-2026-9150)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=35622
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PL7NOS4HGJC62EYY2MRUQZ4UUZOKY7C2/
• https://bugzilla.redhat.com/show_bug.cgi?id=2460975
• https://bugzilla.redhat.com/show_bug.cgi?id=2460380
• https://bugzilla.redhat.com/show_bug.cgi?id=2460379
• https://www.cve.org/CVERecord?id=CVE-2026-48863
• https://www.cve.org/CVERecord?id=CVE-2026-9149
• https://www.cve.org/CVERecord?id=CVE-2026-9150

SRPMS

10/core

• libsolv-0.7.39-1.mga10