CVE-2026-44605 is a heap buffer overflow in RPM's NDB database backend stemming from incorrect memory allocation during file parsing. The CVSS 5.5 score almost certainly understates the risk. Here's what matters for defenders:
The attack surface is narrower than typical CVEs but potentially higher-value. NDB is not the default—SQLite dominates on most Linux distributions—but it's the backend of choice in enterprise RPM deployments running at scale. The systems running NDB are disproportionately infrastructure where RPM operations are automated, privileged, and recurring (boot-time integrity checks, imaging workflows, mass patching). Your population of affected systems may be small, but it's skewed toward high-value targets.
The privilege boundary question is the critical gap. The CVE description says "specially crafted files" without clarifying whether an attacker needs local write access to position a malicious NDB file, or whether the overflow triggers during normal package installation. RPM packages install with root privileges. If NDB parsing runs during package installation, dependency resolution, or database rebuilds invoked by standard install workflows, then the attack surface isn't "local user with write access"—it's "malicious RPM package." That collapses the privilege distinction entirely: the question becomes whether a package needs to already be trusted to trigger the vulnerable code path. The CVE doesn't answer this, and that ambiguity is itself a red flag.
Heap overflow in a privileged rebuild operation changes the threat model. Even if exploitation proves unreliable for arbitrary code execution, you don't need elegant exploitation to cause systemic failure. If the overflow corrupts internal database metadata that subsequent privileged operations trust, you get a persistent DoS or corrupted trust state without needing a controlled write. In enterprise environments where RPM rebuilds run automatically before verification and dependency resolution, the corrupted state can propagate into subsequent privileged operations that never trigger a visible fault.
Prioritize patching on systems running NDB. The remediation for this class of flaw is well-documented—bounds-check length fields before allocation, validate against reasonable upper bounds—which suggests this was an institutional knowledge transfer failure, not a novel defect. The CVSS score will cause organizational deprioritization; don't let it. Systems running NDB have a privileged code path with a known-vulnerable allocation formula, and the exposure window recurs every time RPM rebuilds the database.
Verification steps: Check whether your RPM installations use NDB (rpm --eval '%{_dbpath}' — NDB typically shows a path under /var/lib/rpm/ndb). If NDB is active, treat this as a priority patch regardless of the CVSS score.