DEBIAN-CVE-2026-92824

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-92824
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92824.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-92824
Upstream
  • CVE-2026-92824
Published
2026-10-21T04:18:12Z
Modified
2026-11-07T09:47:30Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

References

Affected packages

Debian:12 / libmodulemd

Package

Name
libmodulemd
Purl
pkg:deb/debian/libmodulemd?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.14.0-3
2.15.0-1
2.15.2-1
2.15.2-2
2.15.2-3
2.15.2-4
2.15.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92824.json"

Debian:13 / libmodulemd

Package

Name
libmodulemd
Purl
pkg:deb/debian/libmodulemd?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.15.0-1
2.15.2-1
2.15.2-2
2.15.2-3
2.15.2-4
2.15.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92824.json"

Debian:14 / libmodulemd

Package

Name
libmodulemd
Purl
pkg:deb/debian/libmodulemd?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.15.0-1
2.15.2-1
2.15.2-2
2.15.2-3
2.15.2-4
2.15.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92824.json"