CVE-2026-103242— Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 rpm 中发现了一个基于堆的缓冲区溢出漏洞。在一个经过恶意构造且未签名的 RPM 软件包的主头文件中，RPMTAG_FILESIGNATURES 字段被声明为错误的头部类型，导致 hex2binv() 函数仅分配了一个字节的缓冲区，随后将攻击者可控的、经过十六进制解码的内容（其长度由攻击者指定）写入该分配区域之外。此漏洞可通过对不可信软件包执行 rpm2cpio、rpm2archive 或 rpm -qlvp 命令触发。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103242
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
Source: CVE Program / CVE List V5
Vulnerability Description
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-103242
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103242
请登录查看更多情报信息。
Other References for CVE-2026-103242 (2)
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie -
CVE-2026-102558
Libsoup: libsoup: heap buffer overflow during websocket rece -
CVE-2026-102555
Libsoup: libsoup: heap buffer overflow via uninitialized len -
CVE-2026-102557
Libsoup: libsoup: heap buffer overflow during websocket mess
Same vendor: Red Hat
-
CVE-2026-62146
Cri-o: cri-o: sandbox state poisoning via pod annotations ma -
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie -
CVE-2026-102558
Libsoup: libsoup: heap buffer overflow during websocket rece -
CVE-2026-102555
Libsoup: libsoup: heap buffer overflow via uninitialized len
V. Comments for CVE-2026-103242
No comments yet