A vulnerability was found in RPM's rpmbuild tarball processing. (CVE-2026-78367)
Description
A vulnerability in RPM's rpmbuild tarball processing allows arbitrary code execution when processing a crafted source archive. The issue arises from the getTarSpec() function passing an attacker-controlled tar archive member name to rpmExpand() within a macro expression, enabling macro and Lua expression injection. Exploitation requires processing a malicious tarball with rpmbuild in tarball mode.
CVSS v3.1
Score 7.0high
Affected software
pkg:deb/ubuntu/rpm?arch=source&distro=trusty/esmpkg:deb/ubuntu/rpm?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/rpm?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/rpm?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/rpm?arch=source&distro=jammypkg:deb/ubuntu/rpm?arch=source&distro=noblepkg:deb/ubuntu/rpm?arch=source&distro=stonkingpkg:deb/ubuntu/rpm?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-78367 is a vulnerability in the RPM package manager's rpmbuild tool, specifically in the tarball processing functionality. The getTarSpec() function in tools/rpmbuild.cc passes a tar archive member name controlled by an attacker to rpmExpand() as part of a %{basename:...} macro expression. This allows injection of RPM macros, including Lua expressions, which can lead to arbitrary code execution with the privileges of the user running rpmbuild. The vulnerability can be exploited when an attacker supplies a specially crafted source tarball processed by rpmbuild using tarball mode options such as -ts, -ta, or -tb.
Potential Impact
Successful exploitation results in arbitrary code execution with the privileges of the user running rpmbuild. This can compromise the system or build environment where rpmbuild processes attacker-controlled source archives. The CVSS 3.1 base score is 7.0 (medium severity), reflecting the requirement for local access and user interaction, and the need for high attack complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted source tarballs with rpmbuild in tarball mode (-ts, -ta, -tb).
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-78367
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5722cdf04f656662120
Added to database: 10/17/2026, 22:23:46 UTC
Last enriched: 10/17/2026, 23:39:45 UTC
Last updated: 10/17/2026, 23:39:45 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.