Log in Start free

Vulnerability · Published Sep 24, 2026 · Assigned by redhat

CVE-2026-95519Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

High 7.8

In plain English

A high-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 96.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-95519
Debian:13rpmno fix listedDEBIAN-CVE-2026-95519
Debian:14rpmno fix listedDEBIAN-CVE-2026-95519
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-95519
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-95519
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-95519
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-95519

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Hardened Images see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References