CVE-2026-44604 is a command injection vulnerability in the rpmuncompress utility of RPM. When extracting archives such as ZIP, 7z, or GEM, the utility uses the archive's top-level folder name in a shell command without proper sanitization, enabling an attacker to execute arbitrary OS commands if the folder name contains shell metacharacters. This vulnerability affects RPM source-preparation workflows in Red Hat Hardened Images, potentially allowing unauthorized command execution with the privileges of the user running the extraction. Standard tar extraction methods are not impacted. Red Hat has released updated RPM packages (version 6.0.1-6.1.hum1) for multiple architectures to fix this issue.

Successful exploitation allows an attacker to execute arbitrary operating system commands as the user performing the extraction, which could lead to unauthorized code execution, data modification, data disclosure, denial of service, or hiding malicious activities. The vulnerability affects build environments using RPM source-preparation workflows. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages (version 6.0.1-6.1.hum1) that fix this vulnerability. Users of Red Hat Hardened Images should apply these updates promptly to mitigate the risk. Since this is a local attack requiring user interaction and high attack complexity, applying the official fix is the recommended mitigation. No additional mitigations are specified by the vendor advisory.