CVE-2026-92824 Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92824?
CVE-2026-92824 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 21 Oct 2026.
Official description
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2026-92824?
How do I fix CVE-2026-92824?
No fix has been published for CVE-2026-92824 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92824 being exploited?
There is no known exploitation of CVE-2026-92824 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-92824, GHSA-j65x-29mg-x4cj, UBUNTU-CVE-2026-92824.