CVE-2026-84233
Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
CVE-2026-84233- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-06
EUVDEUVD-2026-69249
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
EUVD-2026-69249- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-j9c4-6ppm-mvh4
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename...
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
GHSA-j9c4-6ppm-mvh4- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
CVE-2026-84233- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-06
OSVBELL-CVE-2026-84233
- Record
BELL-CVE-2026-84233- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-84233
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
DEBIAN-CVE-2026-84233- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:66637
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:66637- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-84233
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
UBUNTU-CVE-2026-84233- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-99369 No score
CVE-2026-84233 affecting package rpm 4.18.2-2
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
- Record
AZL-99369- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rpmAzure Linux:3 |
through 4.18.2-2 | None known |
rpmAlpaquita:23 |
4.18.0-r2 up to 4.18.0-r3 | 4.18.0-r3 |
rpmAlpaquita:25 |
4.19.1.1-r4 up to 4.19.1.1-r5 | 4.19.1.1-r5 |
rpmAlpaquita:stream |
4.18.0-r1 up to 4.19.1.1-r7 | 4.19.1.1-r7 |
rpmDebian:12 |
All versions, plus listed versions 4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2 Show 15 moreShow less4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmDebian:13 |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
rpmDebian:14 |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 |
None known |
python3-rpmRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpmRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-apidocsRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rpm-buildRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-build-libsRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-cronRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-develRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-libsRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-auditRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-dbus-announceRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-fapolicydRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-fsverityRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-imaRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-prioresetRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-selinuxRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-syslogRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-systemd-inhibitRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-plugin-unshareRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-signRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpm-sign-libsRed Hat:hummingbird:1 |
before 0:6.1.0-1.hum1 | 0:6.1.0-1.hum1 |
rpmUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1 |
None known |
rpmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1 |
None known |
rpmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1 |
None known |
rpmUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1 |
None known |
rpmUbuntu:22.04:LTS |
All versions, plus listed versions 4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1 |
None known |
rpmUbuntu:24.04:LTS |
All versions, plus listed versions 4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2 |
None known |
rpmUbuntu:26.10 |
All versions, plus listed versions 6.0.1-1build16.1.0-1 |
None known |
rpmUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List, EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84233 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 10, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in rpm 4.18.0-r3.