Every CVESearch/Get API key

CVE-2026-84233

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

7.0 HighFix available

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.20%Up 0.1 points since Sep 2, 2026
90%50%10%1%

What each source reports

CVE List Score used7.0

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
CVE-2026-84233
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-12
EUVDEUVD-2026-692497.0

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
EUVD-2026-69249
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-12
GitHub AdvisoriesGHSA-j9c4-6ppm-mvh47.0

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename...

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
GHSA-j9c4-6ppm-mvh4
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-12
NVD7.0

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
CVE-2026-84233
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-12
OSVBELL-CVE-2026-842337.0
Record
BELL-CVE-2026-84233
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-842337.0

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
DEBIAN-CVE-2026-84233
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-13
Show 4 moreShow less
OSVRHSA-2026:666377.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:66637
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:995957.8

Moderate: rpm security update

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

  • rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)

  • rpm: Command Injection in rpmbuild -t* (getTarSpec) via Unescaped Tarball Path (CVE-2026-84837)

  • rpm: Command Execution via Macro Expansion in rpmuncompress -x for Crafted .gem Filenames (CVE-2026-84233)

  • rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:99595
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-842337.0

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
UBUNTU-CVE-2026-84233
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-99369No score

CVE-2026-84233 affecting package rpm 4.18.2-2

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Record
AZL-99369
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm
Azure Linux:3
through 4.18.2-2None known
rpm
Alpaquita:23
4.18.0-r2 up to 4.18.0-r3
4.18.0-r3
rpm
Alpaquita:25
4.19.1.1-r4 up to 4.19.1.1-r5
4.19.1.1-r5
rpm
Alpaquita:stream
4.18.0-r1 up to 4.19.1.1-r7
4.19.1.1-r7
rpm
Debian:12
All versions, plus listed versions
4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2
Show 15 moreShow less
4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
None known
rpm
Debian:13
All versions, plus listed versions
4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
None known
rpm
Debian:14
All versions, plus listed versions
4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
None known
python3-rpm
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-apidocs
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
Show 58 moreShow less
Affected packages
PackageAffectedFixed
rpm-build
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-build-libs
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-cron
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-devel
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-libs
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-audit
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-dbus-announce
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-fapolicyd
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-fsverity
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-ima
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-prioreset
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-selinux
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-syslog
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-systemd-inhibit
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-plugin-unshare
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-sign
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-sign-libs
Red Hat:hummingbird:1
before 0:6.1.0-1.hum1
0:6.1.0-1.hum1
rpm-sign-libs
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-selinux
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-fapolicyd
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-ima-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-libs
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-build
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-dbus-announce-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-selinux-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-dbus-announce
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-audit-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
python3-rpm
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
python3-rpm-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-sign
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-libs-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-syslog
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-debugsource
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-build-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-ima
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-sign-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-devel-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-devel
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-systemd-inhibit
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-sign-libs-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-syslog-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-build-libs-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-build-libs
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-audit
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-fapolicyd-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-plugin-systemd-inhibit-debuginfo
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-cron
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm-apidocs
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:4.19.1.1-29.el10_3
0:4.19.1.1-29.el10_3
rpm
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1
None known
rpm
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1
None known
rpm
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1
None known
rpm
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1
None known
rpm
Ubuntu:22.04:LTS
All versions, plus listed versions
4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1
None known
rpm
Ubuntu:24.04:LTS
All versions, plus listed versions
4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2
None known
rpm
Ubuntu:26.10
All versions, plus listed versions
6.0.1-1build16.1.0-1
None known
rpm
Ubuntu:26.04:LTS
All versions, plus listed versions
4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1
None known

History

History
RecordedChangedSources
affected, aliases, referencesEUVD, NVD, OSV
referencesCVE List
referencesCVE List, EUVD, GitHub Advisories, NVD
factsCVE List, EUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-84233 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 10, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in rpm 4.18.0-r3.

References

Show 11 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open