CVE-2026-95520

Name of the Vulnerable Software and Affected Versions rpm (affected versions not specified)

Description A heap-based buffer overflow occurs when parsing a symlink entry in an untrusted RPM package. If the RPMTAG LONGFILESIZES value is set to 0xFFFFFFFFFFFFFFFF, an integer overflow occurs in the iterReadArchiveNext() function, reducing a buffer allocation to one byte. Subsequently, the cpio filesize field is used to write data beyond the allocated buffer. This issue can be triggered using rpm2cpio, rpm2archive, or the rpm -qlvp command on an untrusted package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.