# CVE-2026-48864: libsolv: A flaw was found in libsolv

CVE-2026-48864 is fixed in 15 products on 1 platform, first by ALAS2023-2026-1798, released June 8, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-48864
- Priority: High
- CVSS: 7.8 (moderate)
- EPSS: 0.0023
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 26, 2026

## Description

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libsolv RHEL 10 | 0.7.29-8.el10_0.1 | [RHSA-2026:48818](https://patchblox.com/security/data/fix/linux/rhsa-2026-48818.md) | Jun 24, 2026 |
| Linux | libsolv RHEL 8 | 0:0.7.20-7.el8_10 | [RHSA-2026:36730](https://patchblox.com/security/data/fix/linux/rhsa-2026-36730.md) | Jul 9, 2026 |
| Linux | libsolv RHEL 9 | 0:0.7.24-6.el9_8 | [RHSA-2026:39315](https://patchblox.com/security/data/fix/linux/rhsa-2026-39315.md) | Jul 18, 2026 |
| Linux | libsolv almalinux 10 | 0.7.33-5.el10_2.alma.1 | [ALSA-2026:28236](https://patchblox.com/security/data/fix/linux/alsa-2026-28236.md) | Jun 23, 2026 |
| Linux | libsolv almalinux 8 | 0.7.20-7.el8_10 | [ALSA-2026:36730](https://patchblox.com/security/data/fix/linux/alsa-2026-36730.md) | Jul 8, 2026 |
| Linux | libsolv almalinux 9 | 0.7.24-6.el9_8 | [ALSA-2026:39315](https://patchblox.com/security/data/fix/linux/alsa-2026-39315.md) | Jul 14, 2026 |
| Linux | libsolv amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv ol 10 | 0:0.7.33-5.el10_2 | [ELSA-2026-28236](https://patchblox.com/security/data/fix/linux/elsa-2026-28236.md) | Jul 16, 2026 |
| Linux | libsolv ol 8 | 0:0.7.20-7.el8_10 | [ELSA-2026-36730](https://patchblox.com/security/data/fix/linux/elsa-2026-36730.md) | Jul 8, 2026 |
| Linux | libsolv ol 9 | 0:0.7.24-6.el9_8 | [ELSA-2026-39315](https://patchblox.com/security/data/fix/linux/elsa-2026-39315.md) | Jul 14, 2026 |
| Linux | libsolv rocky 10 | 0:0.7.33-5.el10_2 | [RLSA-2026:28236](https://patchblox.com/security/data/fix/linux/rlsa-2026-28236.md) | Jun 24, 2026 |
| Linux | libsolv rocky 8 | 0:0.7.20-7.el8_10 | [RLSA-2026:36730](https://patchblox.com/security/data/fix/linux/rlsa-2026-36730.md) | Jul 9, 2026 |
| Linux | libsolv rocky 9 | 0:0.7.24-6.el9_8 | [RLSA-2026:39315](https://patchblox.com/security/data/fix/linux/rlsa-2026-39315.md) | Jul 15, 2026 |
| Linux | libsolv-debuginfo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv-debugsource amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv-demo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv-demo-debuginfo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv-devel RHEL 8 | 0:0.7.20-7.el8_10 | [RHSA-2026:36730](https://patchblox.com/security/data/fix/linux/rhsa-2026-36730.md) | Jul 9, 2026 |
| Linux | libsolv-devel RHEL 9 | 0:0.7.24-6.el9_8 | [RHSA-2026:39315](https://patchblox.com/security/data/fix/linux/rhsa-2026-39315.md) | Jul 18, 2026 |
| Linux | libsolv-devel almalinux 10 | 0.7.33-5.el10_2.alma.1 | [ALSA-2026:28236](https://patchblox.com/security/data/fix/linux/alsa-2026-28236.md) | Jun 23, 2026 |
| Linux | libsolv-devel almalinux 8 | 0.7.20-7.el8_10 | [ALSA-2026:36730](https://patchblox.com/security/data/fix/linux/alsa-2026-36730.md) | Jul 8, 2026 |
| Linux | libsolv-devel almalinux 9 | 0.7.24-6.el9_8 | [ALSA-2026:39315](https://patchblox.com/security/data/fix/linux/alsa-2026-39315.md) | Jul 14, 2026 |
| Linux | libsolv-devel amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv-devel ol 10 | 0:0.7.33-5.el10_2 | [ELSA-2026-28236](https://patchblox.com/security/data/fix/linux/elsa-2026-28236.md) | Jul 16, 2026 |
| Linux | libsolv-devel ol 8 | 0:0.7.20-7.el8_10 | [ELSA-2026-36730](https://patchblox.com/security/data/fix/linux/elsa-2026-36730.md) | Jul 8, 2026 |
| Linux | libsolv-devel ol 9 | 0:0.7.24-6.el9_8 | [ELSA-2026-39315](https://patchblox.com/security/data/fix/linux/elsa-2026-39315.md) | Jul 14, 2026 |
| Linux | libsolv-tools RHEL 8 | 0:0.7.20-7.el8_10 | [RHSA-2026:36730](https://patchblox.com/security/data/fix/linux/rhsa-2026-36730.md) | Jul 9, 2026 |
| Linux | libsolv-tools RHEL 9 | 0:0.7.24-6.el9_8 | [RHSA-2026:39315](https://patchblox.com/security/data/fix/linux/rhsa-2026-39315.md) | Jul 18, 2026 |
| Linux | libsolv-tools almalinux 10 | 0.7.33-5.el10_2.alma.1 | [ALSA-2026:28236](https://patchblox.com/security/data/fix/linux/alsa-2026-28236.md) | Jun 23, 2026 |
| Linux | libsolv-tools almalinux 8 | 0.7.20-7.el8_10 | [ALSA-2026:36730](https://patchblox.com/security/data/fix/linux/alsa-2026-36730.md) | Jul 8, 2026 |
| Linux | libsolv-tools almalinux 9 | 0.7.24-6.el9_8 | [ALSA-2026:39315](https://patchblox.com/security/data/fix/linux/alsa-2026-39315.md) | Jul 14, 2026 |
| Linux | libsolv-tools amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | libsolv-tools ol 10 | 0:0.7.33-5.el10_2 | [ELSA-2026-28236](https://patchblox.com/security/data/fix/linux/elsa-2026-28236.md) | Jul 16, 2026 |
| Linux | libsolv-tools ol 8 | 0:0.7.20-7.el8_10 | [ELSA-2026-36730](https://patchblox.com/security/data/fix/linux/elsa-2026-36730.md) | Jul 8, 2026 |
| Linux | libsolv-tools ol 9 | 0:0.7.24-6.el9_8 | [ELSA-2026-39315](https://patchblox.com/security/data/fix/linux/elsa-2026-39315.md) | Jul 14, 2026 |
| Linux | libsolv-tools-base almalinux 10 | 0.7.33-5.el10_2.alma.1 | [ALSA-2026:28236](https://patchblox.com/security/data/fix/linux/alsa-2026-28236.md) | Jun 23, 2026 |
| Linux | libsolv-tools-base ol 10 | 0:0.7.33-5.el10_2 | [ELSA-2026-28236](https://patchblox.com/security/data/fix/linux/elsa-2026-28236.md) | Jul 16, 2026 |
| Linux | libsolv-tools-debuginfo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | perl-solv amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | perl-solv-debuginfo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | python3-solv RHEL 8 | 0:0.7.20-7.el8_10 | [RHSA-2026:36730](https://patchblox.com/security/data/fix/linux/rhsa-2026-36730.md) | Jul 9, 2026 |
| Linux | python3-solv RHEL 9 | 0:0.7.24-6.el9_8 | [RHSA-2026:39315](https://patchblox.com/security/data/fix/linux/rhsa-2026-39315.md) | Jul 18, 2026 |
| Linux | python3-solv almalinux 10 | 0.7.33-5.el10_2.alma.1 | [ALSA-2026:28236](https://patchblox.com/security/data/fix/linux/alsa-2026-28236.md) | Jun 23, 2026 |
| Linux | python3-solv almalinux 8 | 0.7.20-7.el8_10 | [ALSA-2026:36730](https://patchblox.com/security/data/fix/linux/alsa-2026-36730.md) | Jul 8, 2026 |
| Linux | python3-solv almalinux 9 | 0.7.24-6.el9_8 | [ALSA-2026:39315](https://patchblox.com/security/data/fix/linux/alsa-2026-39315.md) | Jul 14, 2026 |
| Linux | python3-solv amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | python3-solv ol 10 | 0:0.7.33-5.el10_2 | [ELSA-2026-28236](https://patchblox.com/security/data/fix/linux/elsa-2026-28236.md) | Jul 16, 2026 |
| Linux | python3-solv ol 8 | 0:0.7.20-7.el8_10 | [ELSA-2026-36730](https://patchblox.com/security/data/fix/linux/elsa-2026-36730.md) | Jul 8, 2026 |
| Linux | python3-solv ol 9 | 0:0.7.24-6.el9_8 | [ELSA-2026-39315](https://patchblox.com/security/data/fix/linux/elsa-2026-39315.md) | Jul 14, 2026 |
| Linux | python3-solv-debuginfo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | ruby-solv amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |
| Linux | ruby-solv-debuginfo amzn 2023 | 0.7.22-1.amzn2023.0.4 | [ALAS2023-2026-1798](https://patchblox.com/security/data/fix/linux/alas2023-2026-1798.md) | Jun 8, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.