CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
A local attacker can execute arbitrary commands via crafted .gem filenames processed by rpmuncompress, compromising the invoking account.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84233?
CVE-2026-84233 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 1 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Weakness: CWE-78
Which versions are affected by CVE-2026-84233?
Linux distribution packages (20)
python3-rpm Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-apidocs Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-build Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-build-libs Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-cron Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-devel Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-libs Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-audit Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-dbus-announce Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-fapolicyd Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-fsverity Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-ima Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-prioreset Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-selinux Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-syslog Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-systemd-inhibit Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-plugin-unshare Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-sign Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
rpm-sign-libs Red Hat:hummingbird:1 | All versions | 0:6.1.0-1.hum1 |
How do I fix CVE-2026-84233?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-84233 being exploited?
There is no known exploitation of CVE-2026-84233 in the wild and no public exploit code.
Sources
Also known as AZL-99369, BELL-CVE-2026-84233, DEBIAN-CVE-2026-84233, ECHO-c875-8817-b874, GHSA-j9c4-6ppm-mvh4, RHSA-2026:66637 and 1 more.