CVE-2026-78367
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression.
Risk Assessment
A specially crafted .spec member name can inject RPM macros, including Lua expressions, leading to arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball.
Recommendation
Update RPM to a patched version and avoid processing untrusted source archives in rpmbuild tarball mode.
Other vulnerabilities in RPM
See all- CVE-2017-7501High
Versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with the ability to write in a directory where files will be installed could create symbolic links to an arbitrary location, potentially modifying content and permissions of arbitrary files.
- CVE-2014-8118High
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
- CVE-2013-6435High
A race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file. The issue is that the installation extracts the contents to temporary files before validating the signature.
- CVE-2026-44605Medium
A heap buffer overflow vulnerability was found in RPM Package Manager when processing a specially crafted NDB database file. The issue arises from incorrect memory allocation during file parsing. A local user could exploit this to cause a denial of service, making the system unavailable.
Original NVD description (English source)
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).