CVE-2026-103242

Published 30 September 2026 · tracked since 1 October 2026

Description

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen l

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-96343 HIGH 7.2
• CVE-2026-96344 HIGH 7.2
• CVE-2026-95531 HIGH 8.8
• CVE-2026-94677 HIGH 7.2
• CVE-2026-94678 HIGH 8.8
• CVE-2026-94683 HIGH 8.8
• CVE-2026-94121 HIGH 8.8
• CVE-2026-94122 HIGH 7.2
• CVE-2026-94076 HIGH 8.8
• CVE-2026-94081 HIGH 7.1

→ Open the live CVE board · all tools