CVE-2026-84233
Publication date 1 September 2026
Last updated 16 September 2026
Ubuntu priority
Description
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| rpm | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Notes
seth-arnold
Only debugedit and librpmio9 binary packages are in main, and triaged with view to how they are used in the build process as described in https://bugs.launchpad.net/ubuntu/+source/rpm/+bug/1913871
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.0 · High
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H