CVE-2026-95520

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat Rpm

Products

Enterprise Linux Enterprise Linux Hardened Images and 4 more

CVE-2026-103242

Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat Rpm

Products

Enterprise Linux Enterprise Linux Hardened Images and 4 more

CVE-2026-95521

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Hardened Images Hummingbird and 3 more

CVE-2026-95519

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Hardened Images Hummingbird and 3 more

CVE-2006-5466

RPM Crash after listing contents of non-installed package

Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages.

CVSS 2.0 · 5.4 Medium EPSS 3.9% KEV · Not listed

Vendors

Rpm Ubuntu

Products

Package Manager Ubuntu Linux

CVE-2024-1929

Local Root Exploit via Configuration Dictionary

Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration.  Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access. 

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fedora Rpm

Products

Dnf5daemon-server Dnf5

CVE-2017-7501

rpm: Following symlinks to files when installing packages allows privilege escalation

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Rpm

Products

Rpm

CVE-2014-8118

rpm: integer overflow and stack overflow in CPIO header parsing

Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rpm

CVE-2013-6435

rpm: race condition during the installation process

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.

CVSS 2.0 · 7.6 High EPSS 7.6% KEV · Not listed

Vendors

Debian Redhat Rpm

Products

Debian Linux Enterprise Linux Rhel Eus and 2 more

CVE-2012-6088

rpm: Signature checking function returned success on (possibly malicious ) rpm packages

The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package.

CVSS 3.1 · 6.2 Medium EPSS 2.2% KEV · Not listed

Vendors

Rpm

Products

Rpm

CVE-2005-4889

rpm: fails to drop SUID/SGID bits on package removal

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rpm

CVE-2010-2059

rpm: fails to drop SUID/SGID bits on package upgrade

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rpm

CVE-2010-2197

rpm: rpmbuild does not properly parse syntax of spec files

rpmbuild in RPM 4.8.0 and earlier does not properly parse the syntax of spec files, which allows user-assisted remote attackers to remove home directories via vectors involving a ;~ (semicolon tilde) sequence in a Name tag.

CVSS 2.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Rpm

Products

Rpm

CVE-2010-2198

rpm: fails to drop POSIX file capabilities on package upgrade or removal

lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to gain privileges or bypass intended access restrictions by creating a hard link to a vulnerable file that has (1) POSIX file capabilities or (2) SELinux context information, a related issue to CVE-2010-2059.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rpm

Products

Rpm

CVE-2010-2199

rpm: fails to drop POSIX ACLs on package upgrade or removal

lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to bypass intended access restrictions by creating a hard link to a vulnerable file that has a POSIX ACL, a related issue to CVE-2010-2059.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rpm

Products

Rpm

CVE-2011-3378

rpm: crashes and overflows on malformed header

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

CVSS 2.0 · 9.3 Critical EPSS 6.3% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2012-0060

rpm: insufficient validation of region tags

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

CVSS 2.0 · 6.8 Medium EPSS 4.7% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2012-0061

rpm: improper validation of header contents total size in headerLoad()

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.

CVSS 2.0 · 6.8 Medium EPSS 4.7% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2012-0815

rpm: incorrect handling of negated offsets in headerVerifyInfo()

The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.

CVSS 2.0 · 6.8 Medium EPSS 4.2% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2021-3521

rpm: RPM does not require subkeys to have a valid binding signature

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Eus Rpm