Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by redhat

CVE-2026-84233Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

High 7.0

In plain English

A high-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-84233
Debian:13rpmno fix listedDEBIAN-CVE-2026-84233
Debian:14rpmno fix listedDEBIAN-CVE-2026-84233
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-84233
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-84233
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-84233
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-84233

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References