CVE-2026-2625: Stack Buffer Overflow in rpm-sequoia Signature Verification Leading to DoS

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: CVE-2026-2625 (Bug ID: 2440357) Vulnerability Type: Denial of Service (DoS) / Stack Buffer Overflow Detailed Description: A stack buffer overflow exists in the signature parser within the library during RPM signature verification. Maliciously crafted RPM files can trigger this overflow, causing the process to abort unconditionally, resulting in a denial of service. Trigger Conditions: An attacker only needs to deliver a specially crafted RPM file to the victim system. The vulnerability is triggered when the file is processed for signature verification—such as during , , CI pipelines, or automated package validation workflows—without requiring privileges, user interaction, or package installation. Impact Scope Affected Component: (Product: Security Response) Operating System: Linux Hardware Architecture: x86_64 (A4) Severity: Medium Fix Status Current status is NEW; no specific patch or fixed version is currently listed on the page. POC / Exploitation Code No actual proof-of-concept (POC) code block is provided. The exploit method is described only as delivering a crafted RPM file.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-2625: Stack Buffer Overflow in rpm-sequoia Signature Verification Leading to DoS