CVE-2026-9150

medium

Published 2026-05-20 · Modified 2026-05-21

CVSS v3

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2

—

VIR risk

6.5

Description

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-9150.html

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-9150

OS impact

OS	Version	Status	Fixed in
debian	bookworm	affected
debian	bullseye	affected
debian	forky	fixed	`0.7.37-1`
debian	sid	fixed	`0.7.37-1`
debian	trixie	affected
sles		affected

References

CWEs

CWE-121

Verify integrity in audit chain (admin only). AS-IS.