CVE-2026-44604

Technical summary

CVE-2026-44604 is a command injection vulnerability (CWE-78) in RPM's rpmuncompress utility. The tool constructs shell commands that incorporate the top-level directory name from archive files without proper input validation or escaping. When processing ZIP, 7z, or GEM archives, an attacker can craft a specially formatted archive whose folder name contains shell metacharacters (e.g., backticks, dollar signs, semicolons) that break out of the intended command context and execute arbitrary shell code. The vulnerability requires local access and user interaction—specifically, the user must manually extract the attacker-supplied archive—but once triggered, execution occurs with the user's full privileges.

Business impact

This vulnerability creates a supply chain and user interaction risk. Organizations distributing or consuming packaged software via RPM archives face exposure if archives pass through systems using rpmuncompress. An attacker could embed malicious code into a seemingly legitimate archive; any user extracting it would unknowingly execute the payload. For development teams, build systems, or package maintainers routinely extracting archives, this represents a path to unauthorized code execution and potential lateral movement. The impact is amplified in automated or CI/CD contexts where a compromised archive could bootstrap persistent access or data exfiltration.

Affected systems

The vulnerability affects RPM package management systems that include the rpmuncompress utility. Linux distributions relying on RPM (RHEL, Fedora, openSUSE, etc.) and any systems with RPM installed are in scope. The flaw manifests specifically during extraction of ZIP, 7z, and GEM archive formats to a user-specified destination. Systems where users routinely extract archives from untrusted or semi-trusted sources—particularly development workstations and CI/CD infrastructure—face elevated risk.

Exploitability

Exploitation requires two conditions: (1) an attacker must supply or control a specially crafted archive, and (2) a user must extract it using rpmuncompress. The attack cannot be executed remotely or without user action, which lowers opportunistic attack volume. However, the barrier to crafting a malicious archive is trivial—creating a ZIP or 7z file with a shell metacharacter in the folder name requires no special tools. Social engineering (disguising the archive as legitimate software, patches, or data) is the likely attack vector. Once extraction occurs, the attacker gains code execution in the user's security context, potentially including system-level privileges if the extracting user is root or has sudo access.

Remediation

Apply a patch from your RPM vendor that sanitizes or properly escapes folder names before passing them to shell commands. Alternatively, use archive extraction methods that avoid shell command construction entirely. Organizations should verify patch availability from their Linux distribution vendor and deploy it to affected systems. Until patching is complete, restrict user permissions for archive extraction and implement controls limiting which sources users can extract archives from.

Patch guidance

Check your Linux distribution's security advisory for CVE-2026-44604. RHEL, Fedora, openSUSE, and other RPM-based distributions will release patches on their respective timelines. Verify against the vendor advisory for specific patch version numbers and update procedures. Apply patches to all systems running rpmuncompress, with particular urgency for build systems, development machines, and any infrastructure that processes external or untrusted archives. Test patches in a non-production environment before broad deployment.

Detection guidance

Monitor for extraction of archives with unusual characters in folder names—particularly those containing backticks, dollar signs, semicolons, pipes, or other shell metacharacters. Log calls to rpmuncompress and capture archive metadata. Look for unexpected child process spawning from extraction operations, which may indicate command injection. In automated environments, implement archive integrity checking and validate folder names against a whitelist of acceptable patterns. Network monitoring can also detect suspicious outbound connections or data exfiltration following archive extraction events.

Why prioritize this

While the attack requires user interaction and local access, the ease of payload creation, the prevalence of RPM-based systems, and the severity of the outcome (arbitrary code execution) warrant prompt remediation. Development teams, package maintainers, and build infrastructure should prioritize patching. Systems where archive extraction is routine and sources are less tightly controlled should be addressed first. The CVSS 3.1 score of 7.0 (HIGH) reflects the confluence of high integrity and confidentiality impact against the mitigating factors of attack complexity and user interaction.

Risk score, explained

The CVSS 3.1 score of 7.0 is driven by high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), reflecting the potential for complete system compromise through arbitrary code execution. The score is moderated by attack vector restriction to local access (AV:L) and higher attack complexity (AC:H), which account for the requirement to craft a malicious archive and the user interaction needed to trigger extraction (UI:R). The resulting score places this in the HIGH severity category, appropriate for a flaw that can lead to privilege escalation or data compromise but requires deliberate attacker preparation and user action.

Frequently asked questions