CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

This issue is considered Moderate severity because, although successful exploitation allows arbitrary command execution with the privileges of the user or workflow invoking rpmuncompress -x (or a build workflow that invokes it via %{__rpmuncompress}), exploitation requires a specially crafted local .gem filename containing RPM macro syntax to be processed by that tool. The vulnerable code is not exposed as a network service and cannot be triggered remotely without a user or automated workflow invoking rpmuncompress on the attacker-controlled filename.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid using rpmuncompress -x (or a build workflow that invokes it via %{__rpmuncompress}) on .gem files from untrusted sources. Before extraction, rename .gem files to remove any RPM macro syntax (e.g., %(...)) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing