CVE-2026-44604 Command injection in Red Hat Enterprise Linux 10
Attackers can execute arbitrary commands via crafted archives in RPM's rpmuncompress utility due to unsanitized directory names in shell commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44604?
CVE-2026-44604 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 28 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
Weakness: CWE-78
Which versions are affected by CVE-2026-44604?
Linux distribution packages (20)
python3-rpm Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-apidocs Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-build Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-build-libs Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-cron Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-devel Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-libs Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-audit Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-dbus-announce Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-fapolicyd Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-fsverity Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-ima Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-prioreset Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-selinux Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-syslog Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-systemd-inhibit Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-plugin-unshare Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-sign Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
rpm-sign-libs Red Hat:hummingbird:1 | All versions | 0:6.0.1-6.1.hum1 |
How do I fix CVE-2026-44604?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-44604 being exploited?
There is no known exploitation of CVE-2026-44604 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-44604, ECHO-aabb-5650-dee3, GHSA-q856-29gm-xf3x, RHSA-2026:28491, UBUNTU-CVE-2026-44604.