CVE-2026-48863

high

Published 2026-07-16 · Modified 2026-07-18

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.5

Description

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

Predictions

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-48863 NameCVE-2026-48863 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus libsolv (PTS)bullseye0.7.17-1+deb11u1vulnerable bookworm0.7.23-1+deb12u1vulnerable…

CVE-2026-48863

Name	CVE-2026-48863
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsolv (PTS)	bullseye	0.7.17-1+deb11u1	vulnerable
	bookworm	0.7.23-1+deb12u1	vulnerable
	trixie	0.7.32-1	vulnerable
	forky	0.7.37-1	vulnerable
	sid	0.7.39-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsolv	source	(unstable)	0.7.38-1

Notes

[trixie] - libsolv <no-dsa> (Minor issue)
[bookworm] - libsolv <no-dsa> (Minor issue)
[bullseye] - libsolv <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2460975
Fixed by: https://github.com/openSUSE/libsolv/commit/44f8c085045b1f771641091bbb2b810d12cff9e8 (0.7.38)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[trixie] - libsolv <no-dsa> (Minor issue)[bookworm] - libsolv <no-dsa> (Minor issue)[bullseye] - libsolv <no-dsa> (Minor issue)https://bugzilla.redhat.com/show_bug.cgi?id=2460975Fixed by: https://github.com/openSUSE/libsolv/commit/44f8c085045b1f771641091bbb2b810d12cff9e8 (0.7.38)

Source: Microsoft Security Response Center · View original ↗ · proprietary-no-redistribution

Full prose not cached — VIR stores only structured fields (affected/fixed versions, references) for this source. Click "View original" above for the vendor's full advisory.

Affected

Vendor	Product	Version
microsoft	Microsoft Exchange Online
microsoft	Windows Server 2012
microsoft	Windows Server 2012 (Server Core installation)
microsoft	Windows Server 2012 R2
microsoft	Windows Server 2012 R2 (Server Core installation)
microsoft	Microsoft Excel 2016 (32-bit edition)
microsoft	Microsoft Excel 2016 (64-bit edition)
microsoft	Microsoft PowerPoint 2016 (32-bit edition)
microsoft	Microsoft PowerPoint 2016 (64-bit edition)
microsoft	Microsoft Word 2016 (32-bit edition)
microsoft	Microsoft Word 2016 (64-bit edition)
microsoft	Microsoft Office 2016 (32-bit edition)
microsoft	Microsoft Office 2016 (64-bit edition)
microsoft	Windows Server 2016
microsoft	Office Online Server
microsoft	Windows 10 Version 1607 for 32-bit Systems
microsoft	Windows 10 Version 1607 for x64-based Systems
microsoft	Windows Server 2016 (Server Core installation)
microsoft	Microsoft SharePoint Enterprise Server 2016
microsoft	Microsoft SQL Server 2017 for x64-based Systems (GDR)
microsoft	Windows 10 Version 1809 for 32-bit Systems
microsoft	Windows 10 Version 1809 for x64-based Systems
microsoft	Windows Server 2019
microsoft	Windows Server 2019 (Server Core installation)
microsoft	Microsoft Office 2019 for 32-bit editions
microsoft	Microsoft Office 2019 for 64-bit editions
microsoft	Microsoft SharePoint Server 2019
microsoft	Visual Studio Code
microsoft	Windows Admin Center
microsoft	Microsoft .NET Framework 4.8 on Windows Server 2012

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Windows Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Mixed 5 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Fixed	`0.7.38-1`
forky	Fixed	`0.7.38-1`
bullseye	Affected	—
bookworm	Affected	—

References

CWEs

CWE-121

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.