Vulnerability-Lookup

CVE-2026-84233 (GCVE-0-2026-84233)

Vulnerability from cvelistv5 – Published: 2026-09-01 14:53 – Updated: 2026-09-04 02:00

Title

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

Summary

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 01:59 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

redhat redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-84233	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2478409	issue-trackingx_refsource_REDHAT

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Date Public

2026-09-01 13:28

Credits

This issue was discovered by Found by AISLE in partnership with Red Hat.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T01:59:52.859550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:00:03.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."
        }
      ],
      "datePublic": "2026-09-01T13:28:58.612Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:24:10.179Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-84233"
        },
        {
          "name": "RHBZ#2478409",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478409"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-18T03:32:25.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-01T13:28:58.612Z",
          "value": "Made public."
        }
      ],
      "title": "Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this vulnerability, avoid using `rpmuncompress -x` (or a build workflow that invokes it via %{__rpmuncompress}) on `.gem` files from untrusted sources. Before extraction, rename `.gem` files to remove any RPM macro syntax (e.g., `%(...)`) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-84233",
    "datePublished": "2026-09-01T14:53:45.586Z",
    "dateReserved": "2026-09-01T12:20:02.226Z",
    "dateUpdated": "2026-09-04T02:00:03.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-84233",
      "date": "2026-09-09",
      "epss": "0.0013",
      "percentile": "0.02991"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-09T15:04:57.000Z",
      "cve": "CVE-2026-84233",
      "id": "msrc_CVE-2026-84233",
      "initial_release_date": "2026-09-07T02:02:35.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-84233.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-84233\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-09-01T15:17:43.853\",\"lastModified\":\"2026-09-04T02:17:19.897\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rpm\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rpm\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rpm\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rpm\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rpm\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rpm\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-04T01:59:52.859550Z\",\"id\":\"CVE-2026-84233\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-84233\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2478409\",\"source\":\"secalert@redhat.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-02T16:24:06+00:00",
      "cve": "CVE-2026-84233",
      "id": "CVE-2026-84233",
      "initial_release_date": "2026-09-01T13:28:58.612000+00:00",
      "product_status:known_affected": "18",
      "product_status:known_not_affected": "52",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84233.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T00:59:52Z",
      "cve": "CVE-2026-84233",
      "id": "CVE-2026-84233",
      "initial_release_date": "2026-09-02T00:59:52Z",
      "product_status:known_affected": "32",
      "product_status:known_not_affected": "155",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-84233",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-84233.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-84233\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-04T01:59:52.859550Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-04T01:59:58.534Z\"}}], \"cna\": {\"title\": \"Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames\", \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Found by AISLE in partnership with Red Hat.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-18T03:32:25.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-09-01T13:28:58.612Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-09-01T13:28:58.612Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-84233\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2478409\", \"name\": \"RHBZ#2478409\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this vulnerability, avoid using `rpmuncompress -x` (or a build workflow that invokes it via %{__rpmuncompress}) on `.gem` files from untrusted sources. Before extraction, rename `.gem` files to remove any RPM macro syntax (e.g., `%(...)`) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-09-02T16:24:10.179Z\"}, \"x_redhatCweChain\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-84233\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-04T02:00:03.814Z\", \"dateReserved\": \"2026-09-01T12:20:02.226Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-09-01T14:53:45.586Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-84233

Vulnerability from fkie_nvd - Published: 2026-09-01 15:17 - Updated: 2026-09-04 02:17

Severity

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2026-84233
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2478409

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."
    }
  ],
  "id": "CVE-2026-84233",
  "lastModified": "2026-09-04T02:17:19.897",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84233",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-04T01:59:52.859550Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T15:17:43.853",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-84233"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478409"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J9C4-6PPM-MVH4

Vulnerability from github – Published: 2026-09-01 15:31 – Updated: 2026-09-01 15:31

Details

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-84233"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T15:17:43Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.",
  "id": "GHSA-j9c4-6ppm-mvh4",
  "modified": "2026-09-01T15:31:15Z",
  "published": "2026-09-01T15:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84233"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-84233"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478409"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-84233

Vulnerability from csaf_microsoft - Published: 2026-09-07 02:02 - Updated: 2026-09-07 02:02

Summary

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-84233

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-84233.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames",
    "tracking": {
      "current_release_date": "2026-09-07T02:02:35.000Z",
      "generator": {
        "date": "2026-09-07T07:08:56.975Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-84233",
      "initial_release_date": "2026-09-07T02:02:35.000Z",
      "revision_history": [
        {
          "date": "2026-09-07T02:02:35.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 rpm 0:4.18.2-1.azl3",
                "product": {
                  "name": "azl3 rpm 0:4.18.2-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "rpm"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rpm 0:4.18.2-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84233",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "redhat",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-84233.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-09-07T02:02:35.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "17084-1"
          ]
        }
      ],
      "title": "Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames"
    }
  ]
}

ubuntu-cve-2026-84233

Vulnerability from osv_ubuntu

Published

2026-09-02 00:00

Modified

2026-09-03 13:25

Summary

Details

(A flaw was found in rpm. A local attacker could supply a specially cra ...)

Severity

7.0 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-84233	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-84233	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2478409	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "debugedit",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "librpm3",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "librpmbuild3",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "librpmio3",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "librpmsign1",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "python-rpm",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "rpm",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "rpm-i18n",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "4.11.1-3ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@4.11.1-3ubuntu0.1+esm1?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.11.1-2",
        "4.11.1-3",
        "4.11.1-3ubuntu0.1",
        "4.11.1-3ubuntu0.1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "debugedit",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpm3",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmbuild3",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmio3",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmsign3",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "python-rpm",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-rpm",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm-i18n",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@4.12.0.1+dfsg1-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.12.0.1+dfsg1-3build2",
        "4.12.0.1+dfsg1-3build3",
        "4.12.0.1+dfsg1-3ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "debugedit",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpm8",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmbuild8",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmio8",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmsign8",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "python-rpm",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-rpm",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm-i18n",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "4.14.1+dfsg1-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@4.14.1+dfsg1-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.12.0.2+dfsg1-2build2",
        "4.14.0+dfsg1-2",
        "4.14.1+dfsg1-2",
        "4.14.1+dfsg1-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "debugedit",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpm8",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmbuild8",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmio8",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "librpmsign8",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "python-rpm",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-rpm",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm-i18n",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@4.14.2.1+dfsg1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.14.2.1+dfsg1-1",
        "4.14.2.1+dfsg1-1build1",
        "4.14.2.1+dfsg1-1build2",
        "4.14.2.1+dfsg1-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librpm9",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "librpmbuild9",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "librpmio9",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "librpmsign9",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "python3-rpm",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "rpm",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "rpm-i18n",
            "binary_version": "4.17.0+dfsg1-4build1"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "4.17.0+dfsg1-4build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@4.17.0+dfsg1-4build1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.16.1.2+dfsg1-3ubuntu1",
        "4.16.1.2+dfsg1-3ubuntu3",
        "4.17.0+dfsg1-1",
        "4.17.0+dfsg1-3",
        "4.17.0+dfsg1-4",
        "4.17.0+dfsg1-4build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librpm9t64",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "librpmbuild9t64",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "librpmio9t64",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "librpmsign9t64",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "python3-rpm",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "rpm",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "rpm-i18n",
            "binary_version": "4.18.2+dfsg-2.1build2"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "4.18.2+dfsg-2.1build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@4.18.2+dfsg-2.1build2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.18.0+dfsg-1build1",
        "4.18.0+dfsg-1build2",
        "4.18.2+dfsg-1",
        "4.18.2+dfsg-2",
        "4.18.2+dfsg-2.1build1",
        "4.18.2+dfsg-2.1build2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librpm10",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "librpmbuild10",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "librpmio10",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "librpmsign10",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "python3-rpm",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "rpm",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "rpm-common",
            "binary_version": "6.0.1-1build1"
          },
          {
            "binary_name": "rpm2cpio",
            "binary_version": "6.0.1-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rpm",
        "purl": "pkg:deb/ubuntu/rpm@6.0.1-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.20.1+dfsg-3",
        "6.0.0-2",
        "6.0.1-1",
        "6.0.1-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "(A flaw was found in rpm. A local attacker could supply a specially cra ...)",
  "id": "UBUNTU-CVE-2026-84233",
  "modified": "2026-09-03T13:25:52Z",
  "published": "2026-09-02T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-84233"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84233"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478409"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-84233"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-84233 (GCVE-0-2026-84233)

FKIE_CVE-2026-84233

GHSA-J9C4-6PPM-MVH4

MSRC_CVE-2026-84233

ubuntu-cve-2026-84233

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature