A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104949 advisory.

    A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer     overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an     error in how RPM handles certain calculations during file parsing, leading to an incorrect memory     allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3600-1 advisory.

    Security issues fixed:

    - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when     parsing the slot       table (bsc#1269584).

    Other updates and bugfixes:

    - Fix `libelf` handle not being closed, resulting in build errors when using a NFS buildroot     (bsc#1240054).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1991 advisory.

    A heap buffer overflow exists in RPM's NDB database backend (lib/backend/ndb/rpmpkg.c) due to unchecked     32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-disk NDB     header and used in a 32-bit multiplication (slotnpages * (PAGE_SIZE / SLOT_SIZE)) to size a heap     allocation. A crafted Packages.db can supply a slotnpages value that wraps this product to a small number,     causing xcalloc to allocate an undersized buffer. The subsequent loop iterates over the full unwrapped     page count, writing pkgslot entries past the heap boundary before per-slot validation runs. Exploitation     requires the victim to open a crafted NDB database file with RPM tooling, and NDB is not the default     backend in Fedora or RHEL (both default to sqlite). (CVE-2026-44605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9f0d5370e advisory.

    Rebase to 6.0.2 (https://rpm.org/releases/6.0.2)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9985882270 advisory.

    Rebase to 6.0.2 (https://rpm.org/releases/6.0.2)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer     overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an     error in how RPM handles certain calculations during file parsing, leading to an incorrect memory     allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.
    (CVE-2026-44605)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341479	Unity Linux 20.1070e Security Update: rpm (UTSA-2026-104949)	Nessus	Unity Linux Local Security Checks	Local	medium
335090	SUSE SLED15: python3-rpm / python311-rpm / rpm / rpm-32bit / rpm-build / etc (SUSE-SU-2026:3600-1)	Nessus	SuSE Local Security Checks	Local	medium
332015	Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-1991)	Nessus	Amazon Linux Local Security Checks	Local	medium
330301	Fedora 43 : rpm (2026-a9f0d5370e)	Nessus	Fedora Local Security Checks	Local	high
330251	Fedora 44 : rpm (2026-9985882270)	Nessus	Fedora Local Security Checks	Local	high
323916	Linux Distros Unpatched Vulnerability : CVE-2026-44605	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-44605

medium

Tenable Plugins

medium

medium

medium

high

high

medium