A flaw in rpm on Red Hat Enterprise Linux 10 allows arbitrary code execution when processing crafted manifest files with commands like 'rpm -q -p'. The issue arises because manifest entries are macro-expanded before being opened, enabling embedded shell commands to execute with the privileges of the rpm process. This vulnerability requires local execution of rpm against attacker-controlled files and user interaction. The vulnerability is rated with a CVSS 3.1 score of 7.8 (high severity) and impacts confidentiality, integrity, and availability. The vendor advisory states this is a moderate risk due to the required conditions and provides mitigation options including the '--nomanifest' flag and pre-validation of manifest entries.

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the rpm process, potentially leading to full compromise of confidentiality, integrity, and availability of the affected account. However, exploitation requires local access and user interaction to run rpm commands against attacker-supplied files. The vulnerable code is not exposed as a network service, limiting remote exploitation.

Red Hat advises avoiding querying untrusted files with rpm. When handling untrusted inputs, use the '--nomanifest' option to prevent macro expansion of manifest entries. For automated workflows requiring manifest support, pre-validate manifest entries to accept only literal paths or globs and reject macro syntax. These mitigations effectively prevent exploitation. No official patch status is provided in the advisory; check the vendor advisory for updates on fixes.