CVE-2026-95520 Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAGLONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext that shrinks a buffer allocation to one byte, after which the payload's...

CVE-2026-95520

A heap-based buffer overflow vulnerability exists in rpm when parsing untrusted RPM packages. The flaw is triggered when processing a symlink entry where the RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF. This causes an integer overflow in the iterReadArchiveNext() function, shrinking a buffer...