CVE-2026-8423 RPM rpm2compress macro expansion command execution PoC

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: Bug 2478409 (CVE-2026-8423) Title: Command execution vulnerability in rpm caused by macro expansion of a specially crafted filename during Status: NEW Severity: medium Component: vulnerability Operating System: All Hardware: All Version: unspecified CVSS Score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:M -> 7.8 (HIGH) Attack Vector: Local access + user interaction (AV:L, AC:L, PR:N, UI:R) Impact: An attacker can craft a filename containing RPM macro syntax (e.g., ) to trigger macro expansion during extraction, thereby executing arbitrary shell commands. Scope of Impact Affected Component: in Affected Version: Trigger Conditions: - The attacker must be able to control the filename (e.g., by passing a malicious filename during extraction). - No special privileges are required, but the command is executed with the caller's permissions. - In automated build workflows, the vulnerability can be triggered when extracting a file controlled by the attacker using . Remediation Temporary Mitigations: - Until a fix is released, avoid using to extract untrusted files. - Use an extraction tool that filters out non-standard RPM macro syntax. - In automated build workflows, block access to demo paths. Recommended Fix: - Filter and validate filename-derived values via . - Filter and validate in the branch of . POC Code ```c else if (at->at_compress == COMPRESSED_GEM) { char tmp = xstrdup(fn); const char n = basename(tmp); size_t nlen = strlen(n) - 2; char gem = rpmGetPath("%_gem", NULL); char gemversion[nlen]; rstrncpy(gemversion, n, nlen); gemspec = rpmGetPath("%_ts & spec '%s' --ruby '%s'", NULL); zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper = fn; zipper =

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8423 RPM rpm2compress macro expansion command execution PoC

More from this source