CVE-2026-84838

CVE CVE-2026-84838EUVD EUVD-2026-70109Published 2026-09-02T15:13:02.000ZLast changed 2026-09-02T16:24:26.000ZCVSS 7.8

What the advisory describes

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Red Hat — Red Hat Enterprise Linux 10
• Red Hat — Red Hat Enterprise Linux 6
• Red Hat — Red Hat Enterprise Linux 7
• Red Hat — Red Hat Enterprise Linux 8
• Red Hat — Red Hat Enterprise Linux 9
• Red Hat — Red Hat Hardened Images

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Red Hat — Red Hat Enterprise Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.