Catalogo CVE

CVE-2026-84233

A flaw was found in rpm. A local attacker could supply…

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Gravità: High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Sep 1, 2026, 1:28:58 PM UTC
Updated: Sep 1, 2026, 3:17:43 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 27, 2026

Projects and upstream resources

[rpm][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "rpm",
      "status": "vulnerable",
      "release": "sid",
      "version": "6.1.0-1"
    },
    {
      "name": "rpm",
      "status": "vulnerable",
      "release": "forky",
      "version": "6.1.0-1"
    },
    {
      "name": "rpm",
      "status": "vulnerable",
      "release": "trixie",
      "version": "4.20.1+dfsg-3"
    },
    {
      "name": "rpm",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "4.18.0+dfsg-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1146602,
      "name": "rpm",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1146602,
      "name": "rpm",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1146602,
      "name": "rpm",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1146602,
      "name": "rpm",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": []
}

[Debian bug #1146602]

Publisher notes

[trixie] rpm: Minor issue [bookworm] rpm: Minor issue

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[librpm9]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[librpmbuild9]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[librpm-dev]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[librpmio9]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[librpmsign9]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[python3-rpm]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[rpm]Sconosciuto
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[rpm2cpio]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[rpm-common]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
[rpm-i18n]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.18.0+dfsg-1+deb12u1 · all · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12
- 4.18.0+dfsg-1+deb12u1 · all · bookworm
  Interessata
  nvd · rpm · debian · bookworm; nvd · rpm · debian · 12

[Debian 13 (Trixie)]

[librpm10]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[librpmbuild10]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[librpm-dev]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[librpmio10]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[librpmsign10]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[python3-rpm]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[rpm]Sconosciuto
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[rpm2cpio]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[rpm-common]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · amd64 · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · arm64 · trixie
  Interessata
  nvd · rpm · debian · 13
[rpm-i18n]Sconosciuto
Pacchetto sorgente: [rpm]
Dettagli (2)
- 4.20.1+dfsg-3 · all · trixie
  Interessata
  nvd · rpm · debian · 13
- 4.20.1+dfsg-3 · all · trixie
  Interessata
  nvd · rpm · debian · 13

Osservato: Oct 23, 2026, 9:33:27 PM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]