CVE-2026-95519

Name of the Vulnerable Software and Affected Versions rpm (affected versions not specified)

Description A flaw exists where the software processes crafted manifest files during operations such as rpm -q -p or similar manifest-processing flows. The issue occurs because manifest entries undergo macro-expansion before the open() function is called, which allows embedded shell commands to execute with the privileges of the rpm process. This can lead to arbitrary code execution and a full compromise of confidentiality, integrity, and availability for the affected account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.