CVE-2026-95519
Received Received - Intake

Arbitrary Code Execution in RPM Package Manager

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-95519
EUVD
EUVD-2026-85877

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat rpm 6.0.1-5.1.hum1
redhat rpm *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the RPM package manager allows an attacker to execute arbitrary code by supplying a crafted manifest file. When processed via commands like rpm -q -p, manifest entries are macro-expanded before file opening, enabling embedded shell commands to run with the privileges of the rpm process. This can lead to full system compromise.

Detection Guidance

To detect this vulnerability, check if your system uses vulnerable RPM versions and if manifest files are processed without the --nomanifest flag. Look for suspicious manifest files containing RPM macro syntax like %(command). Use commands like rpm -q -p --nomanifest to test if manifest processing is enabled. Monitor for unexpected file writes or command executions in /tmp or system directories.

Impact Analysis

If exploited, this vulnerability can compromise confidentiality, integrity, and availability of the affected system. Attackers could gain control over the system, steal data, modify files, or disrupt services. Exploitation requires a user or automation to process an untrusted file with rpm -q -p or similar commands.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in loss of data confidentiality and integrity, triggering mandatory breach notifications and potential fines.

Mitigation Strategies

Immediately avoid processing untrusted manifest files with rpm -q -p or similar commands. Use the --nomanifest flag to disable manifest fallback. For automation, pre-validate manifest entries to block macro syntax. Upgrade to supported RPM versions if available. Use certified vulnerability scanners to identify affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95519. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart