Skip to content

CVE-2026-78367

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

7.0 HighFix available

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Up 0.1 points since Aug 25, 2026

What each source reports

CVE List Score used7.0

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record: CVE-2026-78367
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-12

EUVDEUVD-2026-648857.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record: EUVD-2026-64885
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-12

GitHub AdvisoriesGHSA-pghw-ch4m-h3f97.0

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a...

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.

Record: GHSA-pghw-ch4m-h3f9
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-74, CWE-94
Updated: 2026-11-02

NVD7.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record: CVE-2026-78367
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-12

OSVDEBIAN-CVE-2026-783677.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record: DEBIAN-CVE-2026-78367
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-07

OSVOESA-2026-38607.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record: OESA-2026-3860
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSVOESA-2026-38617.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record: OESA-2026-3861
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-38627.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record: OESA-2026-3862
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-38637.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record: OESA-2026-3863
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-39287.0

rpm security update

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.(CVE-2026-78367)

Record: OESA-2026-3928
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:823787.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:82378
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:995937.8

Moderate: rpm security update

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

rpm: Command Injection in rpmbuild -t* (getTarSpec) via Unescaped Tarball Path (CVE-2026-84837)
rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:99593
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-13

OSVRLSA-2026:995957.8

Moderate: rpm security update

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)
rpm: Command Injection in rpmbuild -t* (getTarSpec) via Unescaped Tarball Path (CVE-2026-84837)
rpm: Command Execution via Macro Expansion in rpmuncompress -x for Crafted .gem Filenames (CVE-2026-84233)
rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:99595
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-13

OSVUBUNTU-CVE-2026-783677.0

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Record: UBUNTU-CVE-2026-78367
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1792688613No score

rpm: Fix of 3 CVEs

CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t

Record: CLSA-2026-1792688613
Updated: 2026-11-02

OSVCLSA-2026-1792689108No score

rpm: Fix of 3 CVEs

CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t

Record: CLSA-2026-1792689108
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`rpm` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-apidocs` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-build` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-build-libs` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-cron` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-devel` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-libs` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-plugin-systemd-inhibit` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-python` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-sign` TuxCare:OracleLinux:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2

Show 110 moreShow less

Affected packages
Package	Affected	Fixed
`rpm` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-apidocs` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-build` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-build-libs` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-cron` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-devel` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-libs` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-plugin-systemd-inhibit` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-python` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm-sign` TuxCare:RHEL:7 From an advisory covering 3 CVEs	before 4.11.3-48.0.3.el7_9.tuxcare.els2	4.11.3-48.0.3.el7_9.tuxcare.els2
`rpm` Debian:12	All versions, plus listed versions 4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2 Show 15 moreShow less 4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1	None known
`rpm` Debian:13	All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1	None known
`rpm` Debian:14	All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1	None known
`rpm` openEuler:20.03-LTS-SP4	before 4.15.1-66.oe2003sp4	4.15.1-66.oe2003sp4
`rpm` openEuler:22.03-LTS-SP4	before 4.17.0-53.oe2203sp4	4.17.0-53.oe2203sp4
`rpm` openEuler:24.03-LTS-SP1	before 4.18.2-41.oe2403sp1	4.18.2-41.oe2403sp1
`rpm` openEuler:24.03-LTS-SP4	before 4.18.2-41.oe2403sp4	4.18.2-41.oe2403sp4
`rpm` openEuler:24.03-LTS-SP3	before 4.18.2-41.oe2403sp3	4.18.2-41.oe2403sp3
`python3-rpm` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-apidocs` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-build` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-build-libs` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-cron` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-devel` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-libs` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-audit` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-dbus-announce` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-fapolicyd` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-fsverity` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-ima` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-prioreset` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-selinux` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-syslog` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-systemd-inhibit` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-plugin-unshare` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-sign` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`rpm-sign-libs` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.0-1.3.hum1	0:6.1.0-1.3.hum1
`python3-rpm` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`python3-rpm-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-build` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-build-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-build-libs` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-build-libs-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-debugsource` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-devel` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-devel-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-libs` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-libs-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-audit` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-audit-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-fapolicyd` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-fapolicyd-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-ima` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-ima-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-selinux` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-selinux-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-syslog` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-syslog-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-systemd-inhibit` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-plugin-systemd-inhibit-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-sign` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-sign-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-sign-libs` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-sign-libs-debuginfo` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-apidocs` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-cron` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:4.16.1.3-43.el9_9	0:4.16.1.3-43.el9_9
`rpm-sign-libs` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-selinux` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-fapolicyd` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-ima-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-libs` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-build` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-dbus-announce-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-selinux-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-dbus-announce` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-audit-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`python3-rpm` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`python3-rpm-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-sign` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-libs-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-syslog` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-debugsource` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-build-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-ima` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-sign-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-devel-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-devel` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-systemd-inhibit` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-sign-libs-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-syslog-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-build-libs-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-build-libs` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-audit` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-fapolicyd-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-plugin-systemd-inhibit-debuginfo` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-cron` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm-apidocs` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:4.19.1.1-29.el10_3	0:4.19.1.1-29.el10_3
`rpm` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1	None known
`rpm` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1	None known
`rpm` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1	None known
`rpm` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1	None known
`rpm` Ubuntu:22.04:LTS	All versions, plus listed versions 4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1	None known
`rpm` Ubuntu:24.04:LTS	All versions, plus listed versions 4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2	None known
`rpm` Ubuntu:26.10	All versions, plus listed versions 6.0.1-1build16.1.0-1	None known
`rpm` Ubuntu:26.04:LTS	All versions, plus listed versions 4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1	None known

History

History
Recorded	Changed	Sources
Nov 13, 2026	affected, aliases, references	NVD, OSV
Nov 12, 2026	references	CVE List
Nov 12, 2026	references	EUVD, NVD
Nov 12, 2026	references	CVE List, NVD, OSV
Nov 6, 2026	affected, products	CVE List, EUVD, NVD
Nov 6, 2026	facts	CVE List, EUVD
Nov 2, 2026	affected, aliases, references	CVE List
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78367 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 10, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in rpm 4.15.1-66.oe2003sp4.

References

Show 28 moreShow less