Live › vulnerability › CVE-2026-92824
Go to dashboardlibmodulemd, the library that reads and writes Fedora and RHEL module metadata, has an inner loop in the rpm-map emission path that uses the wrong bound. Crafted modulemd v2 metadata with multiple digest types can cause an out-of-bounds read that typically crashes the process, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that run libmodulemd to parse or serialize modulemd v2 metadata from sources a user can influence, such as repository builds or uploaded module files. Systems that only consume trusted, locally built metadata are unlikely to see a crash from an attacker. The sources do not name fixed versions.
No product ranges from the sources yet.
pkg-config --modversion modulemd-2.0 to see the installed libmodulemd versionrpm -q libmodulemd on Fedora or RHEL systemsUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-92824")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.