# CVE-2026-82327

## Summary

- **CVE ID:** CVE-2026-82327
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
- **CWE:** CWE-129
- **Published:** Aug 28, 2026
- **Last Modified:** Aug 28, 2026

## Description

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

## Affected Products

No affected products listed.

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-82327)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2525602)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.11%
- **EPSS Percentile:** 1.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-09._