The rpmuncompress utility in RPM, as used in Red Hat Hardened Images, improperly neutralizes special elements in the top-level folder name of certain archive formats (ZIP, 7z, GEM) during extraction. This leads to an OS command injection vulnerability (CVE-2026-44604) where arbitrary commands can be executed by an attacker if they supply a specially crafted archive with shell metacharacters in the folder name. The vulnerability has a CVSS 3.1 score of 7.0 (High) with attack vector local, high attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Red Hat has issued a security advisory and released updated RPM packages to fix this issue.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the user running the rpmuncompress extraction process. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to trigger but does not require prior privileges. The impact is rated high due to the potential for arbitrary code execution.

Red Hat has released updated RPM packages that fix this vulnerability. Users of Red Hat Hardened Images should apply the security update RHSA-2026:28491 promptly to remediate CVE-2026-44604. Details and update instructions are available at https://access.redhat.com/errata/RHSA-2026:28491. No other mitigations or workarounds are specified in the advisory.