CVE-2026-44605: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-44605 is a heap buffer overflow vulnerability in the RPM Package Manager (RPM) that occurs when processing a specially crafted NDB (New DataBase) database file. The flaw stems from an integer overflow or wraparound (CWE-190) during memory allocation calculations in the NDB slot table parsing code (lib/backend/ndb/rpmpkg.c). It affects RPM versions used in Red Hat Hardened Images prior to 6.0.1-6.2.hum1, and has been assessed with a CVSS v3.1 base score of 5.5 (Medium) by Red Hat (Red Hat CVE, Github Advisory). The vulnerability was reported on May 28, 2026, and publicly disclosed on August 5, 2026, with a patch released the same day (Red Hat Errata).

The root cause is an unchecked 32-bit arithmetic operation in RPM's NDB database backend. Specifically, the slotnpages value is read directly from the on-disk NDB header and used in a 32-bit multiplication (slotnpages * (PAGE_SIZE / SLOT_SIZE)) to size a heap allocation. A crafted Packages.db file can supply a slotnpages value that causes this product to wrap around to a small number, causing xcalloc to allocate an undersized buffer (CWE-190 leading to CWE-787 out-of-bounds write). The subsequent loop then iterates over the full unwrapped page count, writing pkgslot entries past the heap boundary before per-slot validation runs. Exploitation requires user interaction — specifically, a victim must open a crafted NDB database file using RPM tooling (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a denial of service (DoS) by crashing the RPM process, making the system or package management functionality unavailable. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The attack surface is further constrained because NDB is not the default RPM database backend in Fedora or RHEL (both default to SQLite), which Red Hat notes significantly reduces the practical impact on those distributions (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. CISA's SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable with partial technical impact. The EPSS score is approximately 0.135% (3rd percentile), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (Red Hat CVE, Github Advisory).

1. Craft a malicious NDB database file: Create a Packages.db file with a manipulated NDB header where the slotnpages field is set to a value that, when multiplied by (PAGE_SIZE / SLOT_SIZE) in 32-bit arithmetic, wraps around to a small number (integer overflow).
2. Deliver the file to the target: Social-engineer or otherwise cause a local user on the target system to receive the crafted Packages.db file (e.g., via a shared directory, download, or repository substitution).
3. Trigger RPM to process the file: Induce the victim to run an RPM operation that reads the crafted NDB database — for example, rpm --dbpath /path/to/crafted/ -qa or any RPM query/install command pointing to the malicious database path.
4. Trigger heap buffer overflow: RPM's NDB backend calls xcalloc with the wrapped (undersized) size, then iterates over the full page count, writing pkgslot entries beyond the allocated heap buffer boundary.
5. Achieve denial of service: The out-of-bounds write corrupts heap memory, causing the RPM process to crash and making package management unavailable (Red Hat Bugzilla, Red Hat CVE).

• Logs: Unexpected RPM process crashes or segmentation faults in system logs (/var/log/messages, journalctl) associated with RPM operations on non-default database paths.
• File System: Presence of an unexpected or externally sourced Packages.db file in a non-standard RPM database directory (default is /var/lib/rpm/); file modification timestamps inconsistent with normal package management activity.
• Process: RPM processes (rpm, rpm2cpio, rpmdb) terminating abnormally (exit code indicating signal/crash) when operating against an NDB-format database.

Red Hat has released a patched version of RPM (6.0.1-6.2.hum1) for Red Hat Hardened Images via security advisory RHSA-2026:33507, published June 30, 2026 (Red Hat Errata). SUSE has also released a fix (SUSE-SU-2026:3600-1) and Amazon Linux 2023 issued ALAS2023-2026-1991. As a workaround, restrict access to NDB database files to trusted sources only, avoid running RPM operations against untrusted or externally sourced NDB databases, and note that systems using the default SQLite backend (Fedora, RHEL) have a significantly reduced attack surface. Upgrading to the patched RPM version is the recommended remediation (Red Hat CVE).

Red Hat classified this vulnerability as having a Low impact on RHEL and Fedora systems, noting that NDB is not the default RPM database backend in those distributions. The vulnerability was tracked via Red Hat Bugzilla (Bug 2482481) and received coverage from distribution security lists including openSUSE and Amazon Linux. No significant independent researcher commentary or notable social media discussion has been observed beyond standard vulnerability aggregator coverage.