CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
CVE-2026-103242- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-06
EUVDEUVD-2026-89790
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
EUVD-2026-89790- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-446c-w894-m822
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned...
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
GHSA-446c-w894-m822- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
CVE-2026-103242- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-103242
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
DEBIAN-CVE-2026-103242- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-07
OSVOESA-2026-4708
rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below
Security Fix(es):
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.(CVE-2026-103242)
- Record
OESA-2026-4708- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-04
Show 4 moreShow less
OSVOESA-2026-4709
rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below
Security Fix(es):
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.(CVE-2026-103242)
- Record
OESA-2026-4709- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-04
OSVOESA-2026-4710
rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below
Security Fix(es):
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.(CVE-2026-103242)
- Record
OESA-2026-4710- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-103242
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
UBUNTU-CVE-2026-103242- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVAZL-105810 No score
CVE-2026-103242 affecting package rpm 4.18.2-2
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
- Record
AZL-105810- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rpmAzure Linux:3 |
through 4.18.2-2 | None known |
rpmDebian:12 |
All versions, plus listed versions 4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2 Show 15 moreShow less4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmDebian:13 |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmDebian:14 |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmopenEuler:22.03-LTS-SP4 |
before 4.17.0-54.oe2203sp4 | 4.17.0-54.oe2203sp4 |
rpmopenEuler:24.03-LTS-SP1 |
before 4.18.2-43.oe2403sp1 | 4.18.2-43.oe2403sp1 |
rpmopenEuler:24.03-LTS-SP3 |
before 4.18.2-43.oe2403sp3 | 4.18.2-43.oe2403sp3 |
rpmUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1 |
None known |
rpmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1 |
None known |
rpmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rpmUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1 |
None known |
rpmUbuntu:22.04:LTS |
All versions, plus listed versions 4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1 |
None known |
rpmUbuntu:24.04:LTS |
All versions, plus listed versions 4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2 |
None known |
rpmUbuntu:26.10 |
All versions, plus listed versions 6.0.1-1build16.1.0-1 |
None known |
rpmUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| products | CVE List, EUVD, NVD, OSV | |
| affected, aliases, facts, references | OSV | |
| affected, aliases, references | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103242 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in rpm 4.17.0-54.oe2203sp4.