CVE-2026-103242
Received Received - Intake

Heap-based Buffer Overflow in RPM Package

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: redhat-SADP

Description
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103242
EUVD
EUVD-2026-89790

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
redhat rpm *
red_hat rpm 6.0.2
red_hat red_hat_enterprise_linux 8
red_hat openshift_container_platform 4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103242 is a heap-based buffer overflow in the RPM package manager. It occurs when a crafted, unsigned RPM package incorrectly declares the RPMTAG_FILESIGNATURES tag with the wrong header type. This causes the hex2binv() function to allocate a one-byte buffer but then write attacker-controlled, hex-decoded content of arbitrary length beyond that buffer, leading to a heap overflow.

Detection Guidance

To detect this vulnerability, inspect RPM packages for incorrect RPMTAG_FILESIGNATURES header types. Use commands like rpm -qlvp on untrusted packages to check for crashes or errors. Monitor system logs for SIGSEGV crashes when processing RPM files with rpm2cpio or rpm2archive.

Impact Analysis

This vulnerability can cause crashes or potentially arbitrary code execution if exploited. It is reachable via local commands like rpm -qlvp, rpm2cpio, or rpm2archive when processing untrusted RPM packages. Exploitation requires user interaction and local access but could lead to system compromise if an attacker provides a malicious RPM file.

Compliance Impact

This vulnerability primarily affects integrity and availability of systems processing untrusted RPM packages. While it does not directly violate GDPR or HIPAA, it could lead to unauthorized code execution or data corruption if exploited, potentially compromising data integrity required by these standards. Organizations handling sensitive data under GDPR or HIPAA should avoid processing unsigned RPM packages to mitigate risks.

Mitigation Strategies

Avoid processing RPM packages from untrusted or unsigned sources. Do not run vulnerable commands like rpm -qlvp, rpm2cpio, or rpm2archive on unverified files. Update RPM to a patched version once available. Disable automatic RPM processing of untrusted files if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart