The vulnerability in rpmuncompress allows a local attacker to execute arbitrary system commands when a specially crafted archive filename contains shell metacharacters that are not escaped before being passed to popen(). The injection occurs during decompression and can lead to full compromise of the invoking user's privileges, affecting confidentiality, integrity, and availability of data and processes on the host.

Affected systems include Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images that ship the vulnerable rpmuncompress utility. Any product that packages rpmuncompress without addressing the filename escaping flaw is at risk. The advisory lists each major release, from 6 to 10, as impacted.

The CVSS score of 7.8 indicates high severity, while the EPSS value is 1%, suggesting a low but nonzero exploitation probability. The flaw is not catalogued in the CISA KEV list. Successful exploitation requires local user privileges or an automated build process that invokes rpmuncompress on the malicious archive, so the attack vector is local with user interaction. Because the vulnerability grants local code execution, it poses a significant threat to any user or process that triggers rpmuncompress with untrusted filenames.