rpm CVE-2026-95521

Exploitation requires that a victim install, rebuild, or otherwise process an attacker-controlled source package (.src.rpm) whose source or spec file basename contains a %() macro construct; there is no remote network trigger. Limiting factors: local attack vector (the malicious SRPM must reach and be processed on the target host), mandatory user/operator interaction (someone must run rpm/rpmbuild against the untrusted package), and execution confined to the invoking user's privileges (typically non-root, so no inherent root compromise). Highest-risk deployments are build farms, CI/CD pipelines, and packagers that automatically process third-party or untrusted source RPMs.

This is a genuine command-injection flaw (CWE-78) in rpm, the package manager underpinning every RPM-based Linux distribution, so the affected codebase is essentially ubiquitous despite the CPE list naming only Red Hat products. However, the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) is bounded by two important factors: it is a LOCAL attack vector (AV:L) and it requires user interaction (UI:R) - a victim must actively install, rebuild, or otherwise process an attacker-supplied .src.rpm. Code runs only as the invoking (typically non-root, per the description) user, so there is no automatic privilege escalation. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is theoretical rather than observed. There is no SSVC decision data supplied. The realistic priority is moderate: high technical impact (full command execution) but gated by local access plus a deliberate victim action against an untrusted source package. This is a supply-chain / trojaned-package concern (malicious SRPM from an untrusted repo or build farm) more than a broad remote-exploitation threat. No signals conflict; the only tension is that PR:N pairs with a scenario that in practice requires an operator to run rpm on hostile input, which UI:R captures.

An attacker publishes or emails a malicious .src.rpm whose source or spec file basename embeds a %() macro construct wrapping a shell command. When a developer, packager, or CI build system installs or rebuilds that source RPM, rpm relocates the source file list and passes the crafted name to popen(), executing the attacker's command as the invoking user. No public exploit code was identified at time of analysis, but the technique is straightforward to reproduce from the description.