CVE-2026-48863: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-48863 is a stack-based buffer overflow vulnerability in libsolv's PGP verification component, specifically in the EdDSA/Ed25519 signature verification path. The flaw arises from incorrect length handling when copying the EdDSA s MPI into a 64-byte stack buffer — the code uses rlen instead of slen in a memcpy call, allowing a crafted Ed25519 PGP signature with mismatched MPI lengths to overflow the buffer by up to 31 bytes. Affected versions include libsolv 0.6.4 through 0.7.37 (fixed in 0.7.38); Red Hat products are listed as unaffected in their default configurations, while Microsoft Azure Linux 3 (azl3_libsolv_0.7.28-4) is confirmed vulnerable. The vulnerability was disclosed publicly on July 16, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). In ext/solv_pgpvrfy.c, the solv_pgpvrfy() function parses the EdDSA r and s MPIs independently, allowing their byte lengths to differ. The vulnerable line memcpy(sigdata + 64 - slen, s, rlen) incorrectly uses rlen as the copy length instead of slen; if rlen (e.g., 32) exceeds slen (e.g., 1), the copy writes past the end of the 64-byte stack buffer sigdata by up to 31 bytes. Exploitation requires that the target build includes ENABLE_PGPVRFY and Ed25519 support, and that an attacker can deliver a crafted Ed25519 PGP signature to a libsolv consumer for automatic verification — a condition met in common package or repository processing workflows. No privileges or user interaction are required (Red Hat Bugzilla, libsolv commit).

Successful exploitation causes a denial of service by crashing the libsolv consumer process through a stack buffer overflow during PGP signature verification. The impact is limited to availability (High); no confidentiality or integrity impact has been demonstrated, and code execution beyond DoS remains unproven. Systems most at risk are those running automated package management or repository synchronization workflows where attacker-controlled signed content or metadata is processed without prior rejection of malformed packets (Red Hat Bugzilla, Github Advisory).

1. Identify a vulnerable target: Locate systems running libsolv versions 0.6.4–0.7.37 built with ENABLE_PGPVRFY=ON and Ed25519 support enabled (primarily SUSE-based distributions or Azure Linux 3), where automated package or repository metadata verification occurs.
2. Craft a malicious Ed25519 PGP signature: Construct a PGP signature packet where sig[0] = 22 (EdDSA), sig[1] = 8 (SHA-256), followed by a hash prefix, an r MPI with bit length 0x0100 (32 bytes), and an s MPI with bit length 0x0001 (1 byte). This creates a mismatch where rlen=32 and slen=1.
3. Deliver the crafted signature: Host the malicious signed package or repository metadata on an attacker-controlled server, or inject it into a network path (e.g., via a man-in-the-middle attack on an unprotected repository mirror) so that the target system's package manager fetches and processes it automatically.
4. Trigger verification: When the vulnerable libsolv consumer processes the repository metadata or package, solv_pgpvrfy() is called. Execution reaches memcpy(sigdata + 64 - slen, s, rlen), copying 32 bytes starting at sigdata + 63, overflowing the 64-byte stack buffer by 31 bytes.
5. Achieve denial of service: The stack buffer overflow corrupts adjacent stack memory, causing the process to crash and resulting in a denial of service of the package management or repository processing workflow (Red Hat Bugzilla).

• Logs: Unexpected crashes or segmentation faults in package management daemons (e.g., zypper, libzypp, or custom libsolv consumers) during repository refresh or package signature verification operations; AddressSanitizer stack-buffer-overflow reports in ext/solv_pgpvrfy.c at the memcpy call site.
• Process: Abnormal termination of package manager processes (zypper, rpm, or related tools) with signal 11 (SIGSEGV) or signal 6 (SIGABRT) during signature verification phases.
• Network: Unusual or unexpected repository metadata or package files fetched from unfamiliar or newly introduced mirror URLs; HTTP/HTTPS responses delivering PGP-signed content with anomalous signature packet structures.

The upstream fix was committed to libsolv on May 26, 2026 (commit 44f8c08) and included in libsolv version 0.7.38. The fix changes the incorrect memcpy(sigdata + 64 - slen, s, rlen) to memcpy(sigdata + 64 - slen, s, slen) and adds a validation check rejecting signatures where rlen != 32 || slen != 32. SUSE has released updated packages via advisories SUSE-SU-2026:2531-1, SUSE-SU-2026:2575-1, and SUSE-SU-2026:2674-1; Amazon Linux 2023 has also issued ALAS2023-2026-1798. Organizations should upgrade to libsolv 0.7.38 or the patched distribution package as soon as possible; as a temporary workaround, disabling ENABLE_PGPVRFY at build time eliminates the vulnerable code path entirely (libsolv commit, Red Hat Bugzilla, SUSE Advisory).

The libsolv upstream maintainer (Michael Schroeder) confirmed the bug is valid but noted that solv_pgpvrfy.c is not enabled by default and is not known to be used by libzypp in practice; the maintainer indicated the code may be dropped entirely in a future major release. Red Hat assessed the impact as "Important" given the memory-safety nature of the flaw, despite the limited real-world exposure. The vulnerability was credited to "Aisle Research" in the Red Hat Bugzilla report (Red Hat Bugzilla).