CVE-2026-95520

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

View on CVE.org

Published Sep 29, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

Analysis

Technical impact

A heap‑based buffer overflow in rpm occurs when parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF. The integer overflow in iterReadArchiveNext() reduces the allocated buffer to one byte, and an attacker‑controlled cpio file‑size field is then used to write beyond the end of that allocation. This flaw is reachable through rpm2cpio, rpm2archive, and rpm -qlvp when processing an untrusted package, enabling an attacker to potentially execute arbitrary code on the system.

Affected Systems

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, 9 and 10, as well as Red Hat Hardened Images. Any host running an affected rpm version in these distributions is at risk.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium‑to‑high severity flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote use of rpm utilities to process an untrusted RPM package; systems that automatically handle user‑supplied RPMs or run rpm commands on external input are most exposed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Red Hat

Red Hat Hardened Images

affected

Version	Status	Constraints
`6.1.0-1.4.hum1`	unaffected	< *

Red Hat Red Hat Enterprise Linux 10 affected —

Red Hat Red Hat Enterprise Linux 6 unaffected —

Red Hat Red Hat Enterprise Linux 7 unaffected —

Red Hat Red Hat Enterprise Linux 8 affected —

Red Hat Red Hat Enterprise Linux 9 affected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unknown —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

Red Hat Red Hat OpenShift AI (RHOAI) unaffected —

No data.

No data.

Vendor Product Versions

Red Hat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	affected	—	—

Red Hat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Redhat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Redhat

Hardened Images

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Hummingbird

Version	Status	Scheme	Platform
`—`	affected	—	—

Rpm

Rpm

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

To reduce exposure, avoid processing or extracting RPM packages from untrusted sources. Do not use `rpm2cpio`, `rpm2archive`, or `rpm -qlvp` on RPM files whose origin and integrity cannot be verified.

OpenCVE Recommended Actions

Apply the latest Red Hat rpm package update that addresses CVE‑2026‑95520
If an update cannot be applied immediately, avoid processing or extracting RPM files from untrusted sources
Disallow or limit the use of rpm2cpio, rpm2archive, and rpm -qlvp on untrusted packages until a patch is installed

Generated by OpenCVE AI on September 30, 2026 at 03:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.175% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:98095
https://access.redhat.com/security/cve/CVE-2026-95520
https://bugzilla.redhat.com/show_bug.cgi?id=2537809
https://nvd.nist.gov/vuln/detail/CVE-2026-95520
https://www.cve.org/CVERecord?id=CVE-2026-95520

History

Nov 13, 2026 1:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:98095

Nov 10, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Red Hat Red Hat enterprise Linux Redhat hardened Images Rpm Rpm rpm
Vendors & Products		Red Hat Red Hat enterprise Linux Redhat hardened Images Rpm Rpm rpm

Nov 6, 2026 7:45 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat openshift Ai
CPEs		cpe:/a:redhat:openshift_ai
Vendors & Products		Redhat openshift Ai

Nov 6, 2026 2:30 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Els
CPEs	cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9	cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7
Vendors & Products		Redhat rhel Els

Sep 29, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
Title		Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
First Time appeared		Redhat Redhat enterprise Linux Redhat hummingbird
Weaknesses		CWE-787
CPEs		cpe:/a:redhat:hummingbird:1 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux Redhat hummingbird
References		https://access.redhat.com/security/cve/CVE-2026-95520 https://bugzilla.redhat.com/show_bug.cgi?id=2537809 https://nvd.nist.gov/vuln/detail/CVE-2026-95520 https://www.cve.org/CVERecord?id=CVE-2026-95520
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Earlier changes (1)

Subscriptions

Red Hat Enterprise Linux

Redhat Enterprise Linux Hardened Images Hummingbird Openshift Ai Rhel Els

Rpm Rpm

Weaknesses

CWE-787
Out-of-bounds Write

Sources

CVE record Updated: Nov 13, 2026, 1:33 PM

Status: PUBLISHED
Assigner: redhat
Published: Sep 29, 2026, 11:02 AM
Updated: Nov 13, 2026, 1:33 PM
Reserved: Sep 22, 2026, 8:44 AM

View source JSON

Vulnrichment Updated: Sep 29, 2026, 1:17 PM

Updated: Sep 29, 2026, 1:17 PM

NVD Updated: Nov 13, 2026, 2:18 PM

Status: Awaiting Analysis
Published: Sep 29, 2026, 12:17 PM
Modified: Nov 13, 2026, 2:18 PM

View source JSON

Red Hat Updated: Sep 29, 2026, 10:54 AM

Severity: Moderate
Public date: Sep 29, 2026, 10:54 AM

View source Bugzilla JSON

OpenCVE enrichment Updated: Nov 10, 2026, 10:45 PM

Updated: Nov 10, 2026, 10:45 PM

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95520", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-22T08:44:44.967Z", "datePublished": "2026-09-29T11:02:06.457Z", "dateUpdated": "2026-11-13T13:33:52.132Z"}, "containers": {"cna": {"title": "Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rpm-main", "defaultStatus": "affected", "versions": [{"version": "6.1.0-1.4.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rpm", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rpm", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rpm", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rpm", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rpm", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-ai-gateway-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-core-bff-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-dashboard-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-dashboard-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-data-science-pipelines-operator-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-kf-notebook-controller-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-kserve-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-kserve-module-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-kuberay-operator-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-kube-rbac-proxy-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-llama-stack-k8s-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-maas-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mlflow-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mlflow-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-agent-ops-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-automl-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-autorag-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-maas-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-mlflow-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-model-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-model-registry-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-model-serving-api-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-notebook-controller-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-ogx-k8s-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-ogx-module-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-training-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-workbenches-operator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:98095", "name": "RHSA-2026:98095", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-95520", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537809", "name": "RHBZ#2537809", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-29T10:54:13.157Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-787: Out-of-bounds Write", "workarounds": [{"lang": "en", "value": "To reduce exposure, avoid processing or extracting RPM packages from untrusted sources. Do not use `rpm2cpio`, `rpm2archive`, or `rpm -qlvp` on RPM files whose origin and integrity cannot be verified."}], "timeline": [{"lang": "en", "time": "2026-09-18T09:42:14.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-29T10:54:13.157Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank tao pan for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-13T13:33:52.132Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T13:17:45.627559Z", "id": "CVE-2026-95520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T13:19:42.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-95520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T13:17:45.627559Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T13:17:50.012Z"}}], "cna": {"title": "Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages", "credits": [{"lang": "en", "value": "Red Hat would like to thank tao pan for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "rpm", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-ai-gateway-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-core-bff-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-dashboard-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-dashboard-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-data-science-pipelines-operator-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kf-notebook-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-module-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kuberay-operator-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kube-rbac-proxy-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-llama-stack-k8s-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-maas-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mlflow-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mlflow-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-agent-ops-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-automl-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-autorag-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-maas-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-mlflow-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-model-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-model-registry-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-model-serving-api-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-notebook-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-ogx-k8s-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-ogx-module-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-training-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbenches-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-09-18T09:42:14.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-29T10:54:13.157Z", "value": "Made public."}], "datePublic": "2026-09-29T10:54:13.157Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-95520", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537809", "name": "RHBZ#2537809", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To reduce exposure, avoid processing or extracting RPM packages from untrusted sources. Do not use `rpm2cpio`, `rpm2archive`, or `rpm -qlvp` on RPM files whose origin and integrity cannot be verified."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T07:38:05.396Z"}, "x_redhatCweChain": "CWE-787: Out-of-bounds Write"}}, "cveMetadata": {"cveId": "CVE-2026-95520", "state": "PUBLISHED", "dateUpdated": "2026-11-06T07:38:05.396Z", "dateReserved": "2026-09-22T08:44:44.967Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-29T11:02:06.457Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "rpm-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "6.1.0-1.4.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "rpm", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unaffected", "packageName": "rpm", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "unaffected", "packageName": "rpm", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "rpm", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "rpm", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-ai-gateway-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-core-bff-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-dashboard-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-data-science-pipelines-operator-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-kf-notebook-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kserve-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kserve-module-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kuberay-operator-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kube-rbac-proxy-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-llama-stack-k8s-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-maas-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mlflow-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mlflow-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-agent-ops-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-automl-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-autorag-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-maas-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-mlflow-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-registry-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-serving-api-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unknown", "packageName": "rhoai/odh-notebook-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-ogx-k8s-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-ogx-module-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-training-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-trustyai-service-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbenches-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}], "id": "CVE-2026-95520", "lastModified": "2026-11-13T14:18:24.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T13:17:45.627559Z", "version": "2.0.3"}}]}, "published": "2026-09-29T12:17:12.650", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:98095"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-95520"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537809"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank tao pan for reporting this issue.", "bugzilla": {"description": "rpm: rpm: integer overflow in iterReadArchiveNext() leads to heap-based buffer overflow when parsing untrusted RPM packages", "id": "2537809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537809"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."], "mitigation": {"lang": "en:us", "value": "To reduce exposure, avoid processing or extracting RPM packages from untrusted sources. Do not use `rpm2cpio`, `rpm2archive`, or `rpm -qlvp` on RPM files whose origin and integrity cannot be verified."}, "name": "CVE-2026-95520", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rpm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "rpm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "rpm", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "rpm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rpm", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rpm", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-29T10:54:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-95520\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-95520"], "statement": "This issue is rated Moderate because, while parsing a crafted RPM triggers an attacker-controlled-length heap write, exploitation is local: a user or automated workflow must choose to run rpm2cpio, rpm2archive, rpm -qlvp, or an install/rebuild against the untrusted package. The flaw is not exposed as a network service, consistent with other Moderate-rated integer-overflow/heap-overflow flaws already tracked against the same iterReadArchiveNext() symlink-handling code path.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "red_hat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 6", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "red_hat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 6", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "product": "hummingbird", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "rpm", "vendor": "rpm"}], "created": "2026-09-29T16:15:14.679993+00:00", "updated": "2026-11-10T22:45:02.558476+00:00", "vendors": ["red_hat", "red_hat$PRODUCT$enterprise_linux", "redhat", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$hardened_images", "redhat$PRODUCT$hummingbird", "rpm", "rpm$PRODUCT$rpm"]}