Every CVE Search/ Get API key

CVE-2026-78367

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

7.0 HighFix available

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.20%Up 0.1 points since Aug 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record
CVE-2026-78367
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-06
EUVDEUVD-2026-64885 7.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record
EUVD-2026-64885
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-pghw-ch4m-h3f9 7.0

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a...

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.

Record
GHSA-pghw-ch4m-h3f9
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-74, CWE-94
Updated
2026-11-02
NVD 7.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record
CVE-2026-78367
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-06
OSVDEBIAN-CVE-2026-78367 7.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record
DEBIAN-CVE-2026-78367
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVOESA-2026-3860 7.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record
OESA-2026-3860
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVOESA-2026-3861 7.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record
OESA-2026-3861
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3862 7.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record
OESA-2026-3862
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3863 7.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record
OESA-2026-3863
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3928 7.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record
OESA-2026-3928
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:82378 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:82378
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78367 7.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record
UBUNTU-CVE-2026-78367
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1792688613 No score

rpm: Fix of 3 CVEs

  • CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
  • CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
  • CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t
Record
CLSA-2026-1792688613
Updated
2026-11-02
OSVCLSA-2026-1792689108 No score

rpm: Fix of 3 CVEs

  • CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
  • CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
  • CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t
Record
CLSA-2026-1792689108
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-apidocs
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build-libs
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-cron
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-devel
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-libs
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-plugin-systemd-inhibit
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-python
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-sign
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
Show 46 moreShow less
Affected packages
PackageAffectedFixed
rpm
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-apidocs
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build-libs
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-cron
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-devel
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-libs
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-plugin-systemd-inhibit
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-python
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-sign
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm
Debian:12
 All versions, plus listed versions
4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2
Show 15 moreShow less
4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
 None known
rpm
Debian:13
 All versions, plus listed versions
4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
 None known
rpm
Debian:14
 All versions, plus listed versions
4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
 None known
rpm
openEuler:20.03-LTS-SP4
 before 4.15.1-66.oe2003sp4
4.15.1-66.oe2003sp4
rpm
openEuler:22.03-LTS-SP4
 before 4.17.0-53.oe2203sp4
4.17.0-53.oe2203sp4
rpm
openEuler:24.03-LTS-SP1
 before 4.18.2-41.oe2403sp1
4.18.2-41.oe2403sp1
rpm
openEuler:24.03-LTS-SP4
 before 4.18.2-41.oe2403sp4
4.18.2-41.oe2403sp4
rpm
openEuler:24.03-LTS-SP3
 before 4.18.2-41.oe2403sp3
4.18.2-41.oe2403sp3
python3-rpm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-apidocs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-build
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-build-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-cron
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-audit
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-dbus-announce
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-fapolicyd
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-fsverity
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-ima
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-prioreset
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-selinux
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-syslog
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-systemd-inhibit
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-plugin-unshare
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-sign
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm-sign-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.1.0-1.3.hum1
0:6.1.0-1.3.hum1
rpm
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1
 None known
rpm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1
 None known
rpm
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1
 None known
rpm
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1
 None known
rpm
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1
 None known
rpm
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2
 None known
rpm
Ubuntu:26.10
 All versions, plus listed versions
6.0.1-1build16.1.0-1
 None known
rpm
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1
 None known

History

History
RecordedChangedSources
affected, productsCVE List, EUVD, NVD
factsCVE List, EUVD
affected, aliases, referencesCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78367 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 10, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in rpm 4.15.1-66.oe2003sp4.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open