Log in Start free

Vulnerability · Published Sep 24, 2026 · Assigned by redhat

CVE-2026-95521Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

High 7.8

In plain English

A high-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.6%top 52.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-95521
Debian:13rpmno fix listedDEBIAN-CVE-2026-95521
Debian:14rpmno fix listedDEBIAN-CVE-2026-95521
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-95521
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-95521
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-95521
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-95521

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Hardened Images see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References