CVE-2026-92824
CVE-2026-92824 · Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
CVSS 6.2 · Medium · EPSS 0.1%
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat hardened images
No fix published
red hat openshift container platform 4
No fix published
libmodulemd Debian:12
- Versions
- 2.14.0-3
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Debian:13
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Debian:14
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:22.04:LTS
- Versions
- 2.12.0-1
- 2.13.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:24.04:LTS
- Versions
- 2.14.0-3
- 2.14.0-3build1
- 2.14.0-3build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:26.10
- Versions
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:26.04:LTS
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published