The vulnerability originates in the RPM packaging tool where manifest file entries are macro‑expanded before being accessed. A maliciously crafted manifest containing shell commands can therefore be executed with the privileges of the rpm process, giving the attacker full control of the affected account. This flaw results in a complete compromise of confidentiality, integrity, and availability for the system.

Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images are affected. Additionally, the Hummingbird container images may be impacted through the use of rpm within those environments.

The CVSS score of 7.8 classifies the flaw as high severity, and while the EPSS score is not available, the lack of a KEV listing suggests limited active exploitation so far. The attack vector is inferred to be local or semi‑local, as the flaw is triggered when a user or automation process runs rpm with a crafted manifest; however, the underlying mechanism could be leveraged by remote code execution triggers in automation workflows that process untrusted input.