Unrated

DEBIAN-CVE-2026-2644

Type: advisorySource: OSV1 source record

A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the component DIMACS File Parser. This manipulation of the argument variable index with the input 2147483648 causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Announced 18 Feb 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-2644

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-2644

minisat2

Source reference: /affected/0/package/name

Affected versions: 1:2.2.1-5
Source reference: /affected/0/versions
1:2.2.1-6
Source reference: /affected/0/versions
1:2.2.1-7
Source reference: /affected/0/versions
1:2.2.1-8
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

minisat2

Source reference: /affected/1/package/name

Affected versions: 1:2.2.1-8
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

minisat2

Source reference: /affected/2/package/name

Affected versions: 1:2.2.1-8
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "minisat2",
      "purl": "pkg:deb/debian/minisat2?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:2.2.1-5",
      "1:2.2.1-6",
      "1:2.2.1-7",
      "1:2.2.1-8"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2644.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "minisat2",
      "purl": "pkg:deb/debian/minisat2?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1:2.2.1-8"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2644.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "minisat2",
      "purl": "pkg:deb/debian/minisat2?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1:2.2.1-8"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2644.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56282 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:32:11 GMT
Publisher date: Wed, 18 Feb 2026 07:16:11 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-2644 · Revision 1Source updated