rpmbuild EUVD-2026-64885

Exploitation requires that the victim invoke rpmbuild explicitly in tarball mode (using the appropriate rpmbuild flag that triggers tarball-based builds) against a tarball supplied or influenced by the attacker. The victim must be operating on an affected Red Hat-family system (RHEL 6-10, Hardened Images, or OpenShift CP 4). The attacker does not need any account or network access to the victim system but must successfully deliver a malicious tarball and convince the user or an automated pipeline to process it with rpmbuild. Exploitation is limited by: (1) UI:R - user must actively initiate the build; (2) AC:H - the macro injection payload must be precisely crafted to survive tar member name parsing; (3) AV:L - the tarball must reach and be processed on the local system. The attack does not target default system configurations passively; tarball-mode builds are explicitly user-initiated.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H produces a score of 7.0, correctly reflecting the full CIA triad impact offset by local attack vector and high complexity. The AV:L designation is appropriate because the malicious tarball must be processed locally by rpmbuild - the attacker's remote nature is captured through the social engineering channel (UI:R), not a network vector. AC:H reflects that successfully injecting a macro through a tar member name requires precise crafting. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no publicly known POC - exploitation remains theoretical. Real-world risk is primarily elevated in CI/CD pipelines, package maintainer workflows, or developer environments where untrusted tarballs may be built. The impact is significant if exploitation succeeds (full local RCE as the build user), but the combination of required user interaction and high attack complexity meaningfully constrains opportunistic exploitation.

A threat actor publishes or submits a malicious source tarball - for example, as a contribution to an open-source project or as a typosquatted upstream release - containing a tar member whose name embeds RPM macro syntax. A developer or automated CI job downloads this tarball and invokes rpmbuild in tarball mode, causing rpmbuild to expand the malicious macro and execute attacker-controlled commands with the privileges of the build user. No public POC has been identified, but the attack path is mechanically straightforward once the injection gadget within the tar member name is identified.