---
id: "CVE-2026-92824"
kind: "vulnerability"
aliases: ["CVE-2026-92824"]
title: "libmodulemd: crafted module metadata crashes YAML serialization via out-of-bounds read"
severity: "medium"
cvss: 6.2
epss: 0.00117
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fedora", "libmodulemd", "package", "rhel", "rpm-repositories"]
not_affected_if: ["no-untrusted-modulemd-input"]
published_at: "2026-10-21T04:18:12+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:02:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92824", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92824", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# libmodulemd: crafted module metadata crashes YAML serialization via out-of-bounds read

libmodulemd, the library that reads and writes Fedora and RHEL module metadata, has an inner loop in the rpm-map emission path that uses the wrong bound. Crafted modulemd v2 metadata with multiple digest types can cause an out-of-bounds read that typically crashes the process, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `pkg-config --modversion modulemd-2.0` to see the installed libmodulemd version
- `rpm -q libmodulemd` on Fedora or RHEL systems
- Check whether any service parses untrusted modulemd v2 metadata with libmodulemd

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92824
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92824

## From the sources

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_