Description
A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.
Published: 2026-08-05
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A local user may trigger a heap buffer overflow in RPM’s handling of a specially crafted NDB database file. The flaw arises from an incorrect memory allocation during parsing, allowing the attacker to cause a denial of service that renders the system unavailable.

Affected Systems

The vulnerability impacts the RPM package manager in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. All versions listed in the advisory are affected and require the updater package to be replaced with the fixed release.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity; EPSS is not available and the issue is not listed in KEV. Exploitation requires local privileges to supply the malicious NDB file and run RPM, so the risk is limited to systems where an authenticated local user can influence package activities. An attacker can crash the process, causing a denial of service but no code execution.

Generated by OpenCVE AI on August 5, 2026 at 19:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the RPM package to the version provided by RHSA-2026:33507.
  • If the patch is not yet available, remove any untrusted NDB files from the system and do not run RPM with them until the fix is applied.
  • Enable automatic updates and regularly check for new security releases from Red Hat.

Generated by OpenCVE AI on August 5, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.
Title Rpm: heap buffer overflow in ndb slot table parsing
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Weaknesses CWE-190
CPEs cpe:/a:redhat:hummingbird:1
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-05T18:43:41.846Z

Reserved: 2026-05-07T03:57:03.811Z

Link: CVE-2026-44605

cve-icon Vulnrichment

Updated: 2026-08-05T18:43:25.305Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T20:00:12Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound