Description
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Published: 2026-09-01
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Command Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in RPM allows a local attacker to craft a .gem filename that contains RPM macro syntax. When the user or automated process runs rpmuncompress -x on this file, the macro expansion occurs during the construction of the command string. This causes arbitrary commands to be executed with the privileges of the invoking account, compromising confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10 and Red Hat Hardened Images, as well as the Hummingbird distribution. Any system running RPM on these platforms with the affected rpmuncompress utility is potentially impacted.

Risk and Exploitability

The CVSS score of 7 indicates a high severity for local code execution. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local access to supply the malicious .gem filename, and the exploit relies on the presence of rpmuncompress in a workflow or user action. The impact is straightforward: the attacker can run commands as the user executing rpmuncompress.

Generated by OpenCVE AI on September 1, 2026 at 16:42 UTC.

Remediation

Vendor Workaround

To mitigate this vulnerability, avoid using `rpmuncompress -x` (or a build workflow that invokes it via %{__rpmuncompress}) on `.gem` files from untrusted sources. Before extraction, rename `.gem` files to remove any RPM macro syntax (e.g., `%(...)`) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing

OpenCVE Recommended Actions

  • Apply the latest Red Hat updates that contain the RPM patch resolving the macro expansion issue in rpmuncompress – check the advisory https://access.redhat.com/security/cve/CVE-2026-84233 for package details.
  • If an immediate patch is not possible, avoid executing rpmuncompress on files whose names contain any macro syntax characters such as %{ or %} until an update is applied.
  • Configure file‑acceptance policies so that .gem files used by rpmuncompress are strictly validated or renames to strip unsafe characters, thereby preventing macro expansion during decompression.

Generated by OpenCVE AI on September 1, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat hardened Images
Vendors & Products Redhat hardened Images

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 01 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Title Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Weaknesses CWE-78
CPEs cpe:/a:redhat:hummingbird:1
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Hardened Images Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-04T02:00:03.814Z

Reserved: 2026-09-01T12:20:02.226Z

Link: CVE-2026-84233

cve-icon Vulnrichment

Updated: 2026-09-04T01:59:58.534Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T15:17:43.853

Modified: 2026-09-04T02:17:19.897

Link: CVE-2026-84233

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-01T13:28:58Z

Links: CVE-2026-84233 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T16:27:53Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')