The vulnerability exists in rpmbuild's handling of tarballs in tarball mode, where a specially crafted tar member name can cause macro injection. This injection flaw (CWE-74) enables an attacker to execute arbitrary code on the system if a user builds a malicious tarball. The CVSS 3.1 score is 7.0 with metrics indicating local attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the issue but does not currently specify a remediation level or patch availability.

Successful exploitation allows remote code execution on the affected system via local user interaction, potentially leading to full compromise including confidentiality, integrity, and availability impacts. The flaw can bypass protection mechanisms and alter execution logic, resulting in arbitrary code execution and possible unlogged malicious activities.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-78367 for current remediation guidance. Until a fix is available, users should avoid building untrusted or unverified tarballs with rpmbuild. Follow vendor updates for patches or official mitigations.