The rpmuncompress utility in RPM, part of Red Hat Pen Drive Powered by Red Hat Lightspeed, improperly neutralizes special elements in the top-level folder name of certain archive formats (ZIP, 7z, GEM) during extraction. This lack of sanitization allows an attacker to craft an archive with shell metacharacters in the folder name, resulting in OS command injection. The vulnerability is identified as CVE-2026-44604 with a CVSS 3.1 base score of 7.0, indicating high impact on confidentiality, integrity, and availability. The vendor advisory does not currently specify any patch or remediation, and no known exploits are reported in the wild.

Successful exploitation allows arbitrary command execution as the user performing the extraction, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects local users who can supply crafted archives to the rpmuncompress utility. There is no indication of remote exploitation or exploitation in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44604 for current remediation guidance. Until a fix is available, avoid extracting untrusted archives with rpmuncompress or perform extraction in a restricted environment with minimal privileges to limit potential impact.