A flaw in libmodulemd causes an out‑of‑bounds read during YAML serialization of module stream v2 rpm‑map artifacts. The internal loop mistakenly bounds its iteration by the count of digest algorithms instead of the number of checksums in the current digest table. When crafted metadata includes multiple digest types, the read can exceed the bounds of the data buffer, leading to a crash. The crash is typically manifested as a denial of service for the process performing the serialization, and it does not, by default, provide remote code execution or privilege escalation. The weakness is categorized as CWE‑125, an out‑of‑bounds read. The vulnerability does not directly grant access to attacker data but can be used to disrupt services that rely on libmodulemd to process module metadata.

The affected products are Red Hat Enterprise Linux 10, 8, and 9, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The issue resides in the libmodulemd library used by these distributions and platforms to parse and emit module metadata, specifically when handling rpm‑map artifacts in v2 streams.

The CVSS score is 6.2, indicating a moderate severity. The EPSS score is reported as less than 1 %, suggesting that real‑world exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote acceptance of crafted modulemd v2 metadata. Attackers would need to supply crafted modulemd v2 documents containing rpm‑map data with multiple digest types to trigger the out‑of‑bounds read. This could be achieved locally if the system processes untrusted metadata or remotely if a service accepts and serializes such metadata. Due to the lack of a clear remote execution vector, the risk is primarily an availability concern rather than one of confidentiality or integrity.