# CVE-2026-78367: RPM rpmbuild macro injection in tarball processing

Source: https://junglewise.ai/threats/cve-2026-78367-rpm-rpmbuild-macro-injection-in-tarball-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78367 · Severity: high · CVSS 7 · Published 2026-08-24

RPM's rpmbuild tool, used to build software packages from source code, contains a flaw in how it processes source archive files. An attacker can craft a malicious source tarball with specially named files that, when processed by rpmbuild, execute arbitrary code with the privileges of the user running the build. This impacts developers and automated build systems that process untrusted or compromised source code archives.

## Quick answers

**Is CVE-2026-78367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78367 being exploited in the wild.

**How severe is CVE-2026-78367?** High severity, with a CVSS score of 7, published 24 August 2026.

**Which products and versions are affected?** RPM Software Management RPM Unknown.

**Is there a fix for CVE-2026-78367?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78367 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-78367?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The getTarSpec() function in tools/rpmbuild.cc fails to sanitize attacker-controlled tar archive member names before passing them to the rpmExpand() macro processor. A specially crafted .spec file name containing RPM macro syntax (such as %{...} or Lua expressions) can inject and execute arbitrary code. Exploitation requires a victim to manually invoke rpmbuild in tarball mode (-ts, -ta, or -tb) on an attacker-supplied source archive; the vulnerable code is not network-exposed. An attacker can achieve arbitrary code execution with the privileges of the rpmbuild process. Red Hat rates this as Moderate due to the requirement for deliberate processing of untrusted archives, though the impact is complete system compromise.

## Affected products

- RPM Software Management RPM Unknown

## Timeline

- 2026-08-24: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-78367](https://access.redhat.com/security/cve/CVE-2026-78367)