A heap‑based buffer overflow in rpm occurs when parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF. The integer overflow in iterReadArchiveNext() reduces the allocated buffer to one byte, and an attacker‑controlled cpio file‑size field is then used to write beyond the end of that allocation. This flaw is reachable through rpm2cpio, rpm2archive, and rpm -qlvp when processing an untrusted package, enabling an attacker to potentially execute arbitrary code on the system.

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, 9 and 10, as well as Red Hat Hardened Images. Any host running an affected rpm version in these distributions is at risk.

The CVSS score of 7.1 indicates a medium‑to‑high severity flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote use of rpm utilities to process an untrusted RPM package; systems that automatically handle user‑supplied RPMs or run rpm commands on external input are most exposed.