CVE-2026-78367: Improper Control of Generation of Code ('Code Injection') in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in RPM's rpmbuild tarball processing, specifically in the getTarSpec() function in tools/rpmbuild.cc. This function passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the rpmbuild process. Exploitation requires an attacker to supply a crafted source tarball and have it processed by rpmbuild in tarball mode (such as -ts, -ta, or -tb). The vulnerable code is not exposed remotely and cannot be triggered without this specific archive-processing workflow.

Successful exploitation allows arbitrary code execution with the privileges of the user running rpmbuild, potentially compromising system integrity, confidentiality, and availability. However, exploitation requires local or automated build system processing of a malicious source tarball in tarball mode, limiting the attack vector. The vulnerability does not expose a network service and requires user interaction to trigger.

Red Hat advises not to process untrusted tarballs with rpmbuild in tarball mode (-ta, -tb, -ts). Instead, extract and inspect archives first, rejecting member names containing }, %, or {. Alternatively, build from a reviewed .spec file outside tarball mode. Use isolated build environments such as mock or containers for untrusted packaging work. No official patch or fix status is provided yet; check the Red Hat advisory for updates.