CVE-2026-84838

rpmuncompress, a helper utility shipped with the RPM package manager, fails to properly escape shell metacharacters in archive filenames before they are passed to shell command strings, enabling OS command injection (CWE-78). A local attacker must place or offer a specially named archive file, and exploitation occurs only when a user or an automated workflow (for example a package build or CI job) invokes rpmuncompress on that file. Injected commands then execute with the privileges of the invoking user, giving high impact to the confidentiality, integrity, and availability of data accessible to that account. Any system running a vulnerable rpm/rpmuncompress is affected; the data does not specify affected version ranges. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 1%.

What to do: Update the rpm package (including rpmuncompress) once your distributor publishes a patched version, since specific fixed version numbers are not stated in the available data. Meanwhile, avoid running rpmuncompress on untrusted archives with unusual filenames, and audit build servers, CI pipelines, and scripts for automated rpmuncompress calls where an attacker could influence archive names.