Search: CVE-2026-95519

CVE-2026-95519 is a vulnerability in the rpm package manager on Red Hat Enterprise Linux 10. It allows an attacker to supply a crafted manifest file that triggers macro expansion of embedded shell commands during processing by rpm commands such as 'rpm -q -p'. This can lead to arbitrary code execution with the privileges of the rpm process. Exploitation requires local access and user interaction to run rpm against a malicious file. The vulnerability can compromise confidentiality, integrity, and availability of the affected account. Mitigation includes avoiding querying untrusted files with rpm or using the '--nomanifest' option to disable manifest macro expansion.