A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21856-1 advisory.

    Changes in rpm:

    - split imaevmsign plugin into a multibuild flavor

    Changes in rpm:

    - Add Requires: (rpm-plugin-selinux if selinux-policy)
    - harden ndb code [bsc#1269584] [CVE-2026-44605]
    - split all plugins into subpackages
      * this allows for an easy way to get rid of a plugin, it's also         what other distributions do
    - make the imaevmsign plugin build in a multibuild flavor
    - rpm2archive: use size 0 for hardlinked files as bnew versions of       gnu tar reject non-zero sizes [bsc#1269150]
    - backport fix for add_sysuser macro [bsc#1269571]
    - backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
    - switch from rpmpgp_legacy to libpgpr
      * multiple bug fixes, support for v5 and v6 signatures
    - turn on imaevm file signature support and move the imaevm code       that needs the libimaevm library into a plugin. Put this       plugin into a new rpm-imaevmsign subpackage. [jsc#PED-7246]
    - Fix unexpected EOF when using rpmbuild to install ELF binaries       due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)
    - Remove /var/lib/rpm migration scripting, retain an error if old       location is found
    - Use systemd-tmpfiles to create & maintain /var/lib/rpm symlink       (boo#1253139)
    - flush scriptlet notification messages in --runposttrans
      * needed to fix leaking tmp files [bsc#1218459]
      * added rpm_flushes_runposttrans provides for libzypp

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A heap-based buffer overflow vulnerability was found in RPM's NDB (New Database) backend in the     lib/backend/ndb/rpmpkg.c file. This vulnerability is classified as critical and could affect     confidentiality, integrity, and availability of the system.(CVE-2026-44605)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization rpm security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A heap-based buffer overflow vulnerability was found in RPM's NDB (New Database) backend in the     lib/backend/ndb/rpmpkg.c file. This vulnerability is classified as critical and could affect     confidentiality, integrity, and availability of the system.(CVE-2026-44605)

Tenable has extracted the preceding description block directly from the EulerOS rpm security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104949 advisory.

    A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer     overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an     error in how RPM handles certain calculations during file parsing, leading to an incorrect memory     allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3600-1 advisory.

    Security issues fixed:

    - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when     parsing the slot       table (bsc#1269584).

    Other updates and bugfixes:

    - Fix `libelf` handle not being closed, resulting in build errors when using a NFS buildroot     (bsc#1240054).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1991 advisory.

    A heap buffer overflow exists in RPM's NDB database backend (lib/backend/ndb/rpmpkg.c) due to unchecked     32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-disk NDB     header and used in a 32-bit multiplication (slotnpages * (PAGE_SIZE / SLOT_SIZE)) to size a heap     allocation. A crafted Packages.db can supply a slotnpages value that wraps this product to a small number,     causing xcalloc to allocate an undersized buffer. The subsequent loop iterates over the full unwrapped     page count, writing pkgslot entries past the heap boundary before per-slot validation runs. Exploitation     requires the victim to open a crafted NDB database file with RPM tooling, and NDB is not the default     backend in Fedora or RHEL (both default to sqlite). (CVE-2026-44605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9f0d5370e advisory.

    Rebase to 6.0.2 (https://rpm.org/releases/6.0.2)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9985882270 advisory.

    Rebase to 6.0.2 (https://rpm.org/releases/6.0.2)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer     overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an     error in how RPM handles certain calculations during file parsing, leading to an incorrect memory     allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.
    (CVE-2026-44605)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347917	openSUSE 16: librpmbuild10 / python313-rpm / rpm / rpm-build / rpm-devel / etc (openSUSE-SU-2026:21856-1)	Nessus	SuSE Local Security Checks	Local	high
347246	EulerOS Virtualization 2.12.0 : rpm (EulerOS-SA-2026-3670)	Nessus	Huawei Local Security Checks	Local	medium
347206	EulerOS Virtualization 2.12.1 : rpm (EulerOS-SA-2026-3616)	Nessus	Huawei Local Security Checks	Local	medium
343726	EulerOS 2.0 SP12 : rpm (EulerOS-SA-2026-3382)	Nessus	Huawei Local Security Checks	Local	medium
343672	EulerOS 2.0 SP12 : rpm (EulerOS-SA-2026-3307)	Nessus	Huawei Local Security Checks	Local	medium
341479	Unity Linux 20.1070e Security Update: rpm (UTSA-2026-104949)	Nessus	Unity Linux Local Security Checks	Local	medium
335090	SUSE SLED15: python3-rpm / python311-rpm / rpm / rpm-32bit / rpm-build / etc (SUSE-SU-2026:3600-1)	Nessus	SuSE Local Security Checks	Local	medium
332015	Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-1991)	Nessus	Amazon Linux Local Security Checks	Local	medium
330301	Fedora 43 : rpm (2026-a9f0d5370e)	Nessus	Fedora Local Security Checks	Local	high
330251	Fedora 44 : rpm (2026-9985882270)	Nessus	Fedora Local Security Checks	Local	high
323916	Linux Distros Unpatched Vulnerability : CVE-2026-44605	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-44605

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

high

high

medium