Description

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-24T14:17:04.767Z",
  "pubdate": "2026-08-24T14:17:04.767Z",
  "executiveSummary": "A macro injection vulnerability exists in rpmbuild when processing crafted tarballs in tarball mode. The vulnerability allows a remote attacker to achieve arbitrary code execution on a victim's system. The primary vector requires convincing a user to build a malicious tarball containing specially designed tar member names. Successful exploitation compromises the integrity and confidentiality of the host system operating the build process, translating to a high-severity risk for development and packaging environments where untrusted source archives may be processed.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient sanitization and validation of tar member names when processed by rpmbuild in tarball mode. During the extraction and parsing phases of archive processing, specific strings within tar member names are improperly handled and interpreted as internal macro definitions or expansion commands.\nThe attack flow begins when an attacker crafts a malicious tarball containing a tar member with a specially engineered name designed to trigger macro injection upon processing. The attacker distributes this archive to a target victim. When the victim initiates the rpmbuild utility to process the malicious tarball in tarball mode, the vulnerable component parses the archive entries.\nAs the archive is processed, the malicious tar member name is evaluated by the rpmbuild macro expansion engine. Instead of treating the member name as literal string data, the parsing engine interprets embedded macro syntax, allowing the injection and subsequent execution of arbitrary commands embedded within the archive structure.\nPrerequisites for this attack include the victim executing rpmbuild against an untrusted tarball provided by the attacker. Authentication is not required within the context of the build process itself, and exploitation relies heavily on social engineering to trick the user into building the malicious archive. The execution context inherits the privileges of the user running the rpmbuild utility, potentially leading to arbitrary code execution within the security context of that user."
}