CVE-2026-95519 Red Hat CVE debrief

Who should care

Defenders responsible for systems using rpm, especially those processing untrusted manifest files, should assess exposure and prioritize mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and mitigate the vulnerability to prevent potential compromise of confidentiality, integrity, and availability.

Why it matters

CVE-2026-95519 is a high-severity vulnerability in rpm that allows arbitrary code execution via crafted manifest files. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where untrusted manifest files may be processed. The vulnerability's impact includes potential compromise of confidentiality, integrity, and availability. However, details on affected versions and remediation are limited, requiring further verification from official sources.

• Potential arbitrary code execution with elevated privileges.
• Possible compromise of confidentiality, integrity, and availability.
• Need for verification of affected versions and remediation status.
• Priority on restricting access to manifest files and validating their contents.

Technical summary

A flaw in rpm allows an attacker to supply a crafted manifest file that, when processed, leads to arbitrary code execution due to unexpected macro-expansion of manifest entries. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. The vulnerability affects systems using rpm, especially those processing untrusted manifest files.

Defensive priority

Defenders should prioritize verifying and mitigating the vulnerability in rpm, especially in environments where untrusted manifest files may be processed.

Recommended defensive actions

• Verify the rpm version and configuration in your environment.
• Restrict access to manifest files and ensure they are validated before processing.
• Monitor for suspicious activity related to rpm processes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in rpm. Additional information on affected versions and remediation is limited. Defenders should verify and mitigate the vulnerability, especially in environments where untrusted manifest files may be processed. The vulnerability's impact includes potential compromise of confidentiality, integrity, and availability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.