Fedora RPM Vulnerabilities: Heap Overflow and Command Injection Advisories

Two vulnerabilities have been identified in the RPM Package Manager affecting Fedora 43 and 44. CVE-2026-44604, published on 2026-05-28, details a command injection flaw in the 'rpmuncompress' function, while CVE-2026-44605 describes a heap buffer overflow in NDB slot table parsing. These vulnerabilities could allow attackers to execute arbitrary commands or cause system instability. Users of Fedora 43 and 44 are advised to update their systems immediately using the 'dnf' package manager. The vulnerabilities were confirmed by Michal Domonkos in updates released on July 16, 2026. The advisory emphasizes the importance of auditing Linux privileges to mitigate potential exploitation. The updates are available through the advisory links provided.

Key Points: • CVE-2026-44604 and CVE-2026-44605 affect Fedora 43 and 44 RPM Package Manager. • The vulnerabilities allow for command injection and heap buffer overflow attacks. • Users are urged to apply patches immediately to prevent exploitation.