Log in Start free

Vulnerability · Published Aug 24, 2026 · Assigned by redhat

CVE-2026-78367Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

High 7.0

In plain English

A high-severity code injection in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-78367
Debian:13rpmno fix listedDEBIAN-CVE-2026-78367
Debian:14rpmno fix listedDEBIAN-CVE-2026-78367
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-78367
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-78367
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-78367
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-78367

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References