Libsolv contains a stack‑based buffer overflow in the PGP verification component due to incorrect length handling when copying the 's' MPI of an EdDSA signature into a stack buffer. The flaw allows a remote attacker to craft a malicious Ed25519 PGP signature with mismatched MPI lengths, which can trigger the overflow during verification and terminate the process. This results in a denial of service to automated package or repository processing workflows without affecting confidentiality or integrity.

The CVE entry does not list specific distributors or product versions. libsolv is a library used in many Linux distribution package managers and related tools. Any installation that relies on an unpatched version of libsolv for handling PGP signatures could be affected. Based on the description, it is inferred that the vulnerability impacts those systems that automatically process PGP‑signed packages or repositories.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable remotely by an attacker who can supply a crafted EdDSA PGP signature to the verification routine. The attack requires only malicious input and can be carried out within automated package or repository processing workflows, potentially impacting availability of systems that depend on libsolv.