Executive brief
RPM's rpmbuild tool, used to build software packages from source code, contains a flaw in how it processes source archive files. An attacker can craft a malicious source tarball with specially named files that, when processed by rpmbuild, execute arbitrary code with the privileges of the user running the build. This impacts developers and automated build systems that process untrusted or compromised source code archives.
Technical details
The getTarSpec() function in tools/rpmbuild.cc fails to sanitize attacker-controlled tar archive member names before passing them to the rpmExpand() macro processor. A specially crafted .spec file name containing RPM macro syntax (such as %{...} or Lua expressions) can inject and execute arbitrary code. Exploitation requires a victim to manually invoke rpmbuild in tarball mode (-ts, -ta, or -tb) on an attacker-supplied source archive; the vulnerable code is not network-exposed. An attacker can achieve arbitrary code execution with the privileges of the rpmbuild process. Red Hat rates this as Moderate due to the requirement for deliberate processing of untrusted archives, though the impact is complete system compromise.
Affected products
- RPM Software Management RPM Unknown
Timeline
- 2026-08-24: disclosed