repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libsolv-perl": "0.6.36-2", "libsolvext0": "0.6.36-2", "libsolv0-dev": "0.6.36-2", "libsolv-tools": "0.6.36-2", "libsolv0-dbgsym": "0.6.36-2", "libsolv-perl-dbgsym": "0.6.36-2", "python3-solv-dbgsym": "0.6.36-2", "libsolv-tools-dbgsym": "0.6.36-2", "libsolv-doc": "0.6.36-2", "python3-solv": "0.6.36-2", "libsolv0": "0.6.36-2", "libsolvext0-dbgsym": "0.6.36-2", "libsolvext0-dev": "0.6.36-2" } ] }