CVE-2026-92824
Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
Using Red Hat Enterprise Linux 10 by Red Hat?
Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 10 - before attackers find them.
Description
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
VTDB RemediationWorkaround
VTDB RemediationAI-generated · claude-fable-5-1 · published by VulnTracker
No fixed libmodulemd package is recorded yet; track the Red Hat CVE page for an erratum and, until then, avoid serialising modulemd v2 metadata from untrusted sources on RHEL, OpenShift and Hardened Images hosts.
- 1
Inventory hosts and images carrying libmodulemd
All versions of Red Hat Enterprise Linux, OpenShift Container Platform and Red Hat Hardened Images are recorded as affected. List hosts and container images with the libmodulemd package installed, and note which tooling on them (package managers, build pipelines, repository tooling) serialises modulemd v2 metadata.
Affected entries: redhat-enterprise-linux, redhat-openshift-container-platform, redhat-hardened-images, all_versions true.
- 2
Watch the Red Hat CVE page for a fixed package
Our records contain no fix row, so no fixed libmodulemd version or erratum can be named. Check the Red Hat CVE page for the per-product fix state and apply the libmodulemd update when an erratum is published for your RHEL release or OpenShift version.
https://access.redhat.com/security/cve/CVE-2026-92824 - 3
Limit processing of untrusted modulemd metadata
The crash requires crafted modulemd v2 metadata with multiple digest types to reach the rpm-map YAML serialisation path. Restrict repository and module metadata sources to trusted, signed repositories, and keep untrusted module YAML out of build and mirroring pipelines until the package is fixed.
Description: crafted modulemd v2 metadata with multiple digest types triggers an out-of-bounds read during YAML serialization.
- 4
Rebuild affected container images once the fix ships
Hardened Images and OpenShift components ship libmodulemd inside images, so patching the host is not enough; rebuild or pull updated images after the erratum is released.
Affected entries include redhat-hardened-images and redhat-openshift-container-platform.
If you cannot apply the fix
Confine modulemd metadata processing to trusted sources; the flaw is local and availability-only (CVSS 6.2, AV:L/A:H), so the practical exposure is tooling that parses attacker-supplied module YAML.
No fix row is recorded, so whether a fixed libmodulemd build exists for any affected product is not established; the Red Hat CVE page is the only vendor source on file and its content is not summarised in our records. The affected entries are the products, not the libmodulemd package version, so the vulnerable package range is unknown. Neither reference is tagged Patch or Vendor Advisory. Exploitation is not recorded and no EPSS score is present.
Guidance updated 2026-10-21
References (2)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.