CVE-2026-95519
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
CVE-2026-95519- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-06
EUVDEUVD-2026-85877
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
EUVD-2026-85877- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-r6wm-889r-jqv7
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a...
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
GHSA-r6wm-889r-jqv7- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
CVE-2026-95519- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-95519
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
DEBIAN-CVE-2026-95519- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-95519
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
UBUNTU-CVE-2026-95519- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-105329 No score
CVE-2026-95519 affecting package rpm 4.18.2-2
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
- Record
AZL-105329- Updated
- 2026-11-05
OSVCLSA-2026-1792688613 No score
rpm: Fix of 3 CVEs
- CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
- CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
- CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t
- Record
CLSA-2026-1792688613- Updated
- 2026-11-02
OSVCLSA-2026-1792689108 No score
rpm: Fix of 3 CVEs
- CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
- CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
- CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t
- Record
CLSA-2026-1792689108- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rpmAzure Linux:3 |
through 4.18.2-2 | None known |
rpmTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-apidocsTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-buildTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-build-libsTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-cronTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-develTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-libsTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-plugin-systemd-inhibitTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-pythonTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rpm-signTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpmTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-apidocsTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-buildTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-build-libsTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-cronTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-develTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-libsTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-plugin-systemd-inhibitTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-pythonTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpm-signTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 4.11.3-48.0.3.el7_9.tuxcare.els2 | 4.11.3-48.0.3.el7_9.tuxcare.els2 |
rpmDebian:12 |
All versions, plus listed versions 4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2 Show 15 moreShow less4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmDebian:13 |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmDebian:14 |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1 |
None known |
rpmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1 |
None known |
rpmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1 |
None known |
rpmUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1 |
None known |
rpmUbuntu:22.04:LTS |
All versions, plus listed versions 4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1 |
None known |
rpmUbuntu:24.04:LTS |
All versions, plus listed versions 4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2 |
None known |
rpmUbuntu:26.10 |
All versions, plus listed versions 6.0.1-1build16.1.0-1 |
None known |
rpmUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts, products | CVE List, EUVD, NVD | |
| facts | EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-95519 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. No source names a fixed version.