Skip to content
Fencer Vulns
medium 5.5

CVE-2026-44605 json

Rpm: heap buffer overflow in ndb slot table parsing

published 2026-08-05 3 mo ago modified 2026-11-06 2 d ago also EUVD-2026-53565

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

Patch / fix

  • Red Hat Red Hat Hardened Images 6.0.1-6.2.hum1
  • rpm hummingbird 1 6.0.1-6.2.hum1
  • rpm-cron hummingbird 1 6.0.1-6.2.hum1
  • rpm-libs hummingbird 1 6.0.1-6.2.hum1
  • rpm-sign hummingbird 1 6.0.1-6.2.hum1
  • rpm-build hummingbird 1 6.0.1-6.2.hum1
  • python3-rpm hummingbird 1 6.0.1-6.2.hum1
  • rpm-apidocs hummingbird 1 6.0.1-6.2.hum1
  • rpm-sign-libs hummingbird 1 6.0.1-6.2.hum1

red hat advisories RHSA-2026:33507

  • rpm SLE Micro 5.3 4.14.3-150300.58.1
  • rpm-ndb SLE Micro 5.3 4.14.3-150300.58.1
  • python-rpm SLE Micro 5.3 4.14.3-150300.58.1
  • rpm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.20.1-160000.3.1
  • python-rpm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.20.1-160000.3.1
  • rpm-plugin-imaevmsign SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.20.1-160000.3.1
  • rpm Linux Micro 6.1 4.18.0-slfo.1.1_3.1
  • python-rpm Linux Micro 6.1 4.18.0-slfo.1.1_3.1

suse advisories SUSE-SU-2026:4457-1SUSE-SU-2026:23787-1SUSE-SU-2026:23796-1SUSE-SU-2026:23192-1SUSE-SU-2026:23204-1SUSE-SU-2026:3600-1

  • rpm openSUSE Leap 16.0 4.20.1-160000.3.1
  • python-rpm openSUSE Leap 16.0 4.20.1-160000.3.1
  • rpm-plugin-imaevmsign openSUSE Leap 16.0 4.20.1-160000.3.1
  • rpm openSUSE Tumbleweed 4.20.1-8.1

opensuse advisories openSUSE-SU-2026:21856-1openSUSE-SU-2026:11193-1

  • rpm Azure Linux 3.0 4.18.2-2

azure linux advisories AZL-94665

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44605 updated cvss 5.5

rpm: heap buffer overflow in NDB slot table parsing

  • Red Hat Enterprise Linux 6 rpm, rpm-cron, rpm-libs, rpm-build, rpm-python, rpm-apidocs Red Hat Enterprise Linux 7 rpm, rpm-cron, rpm-libs, rpm-sign, rpm-build, rpm-python, +3 more Red Hat Enterprise Linux 8 rpm, rpm-cron, rpm-libs, rpm-sign, rpm-build, python3-rpm, +8 more Red Hat Enterprise Linux 9 rpm, bootupd, rpm-cron, rpm-libs, rpm-sign, rpm-build, +11 more Red Hat Enterprise Linux 10 rpm, rust-bootupd
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Hardened Images rpm 6.0.1-6.2.hum1, rpm-cron 6.0.1-6.2.hum1, rpm-libs 6.0.1-6.2.hum1, rpm-sign 6.0.1-6.2.hum1, rpm-build 6.0.1-6.2.hum1, python3-rpm 6.0.1-6.2.hum1, +13 more
    fixed: vendor fix RHSA-2026:33507
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.