CVE-2026-95519 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
Attackers can execute arbitrary code by providing a crafted manifest file processed by rpm, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-95519?
CVE-2026-95519 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 24 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
Weakness: CWE-78
Which versions are affected by CVE-2026-95519?
How do I fix CVE-2026-95519?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-95519 being exploited?
There is no known exploitation of CVE-2026-95519 in the wild and no public exploit code.
Sources
Also known as AZL-105329, DEBIAN-CVE-2026-95519, ECHO-d6c8-f97d-87b6, GHSA-r6wm-889r-jqv7, UBUNTU-CVE-2026-95519.