Red Hat Red Hat Enterprise Linux 10 Code Injection Permits Remote Code Execution
Last refreshed2026-10-15
Status: UPDATED
| Advisory ID: CVE-2026-78367
Key Details
CVE
CVE-2026-78367
CVSS Score / Version
7.0 (High) / CVSS v3.1
Updated
2026-10-14
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is local; attack complexity is high; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, and Red Hat Hardened Images
Classified as
CWE-94 (Improper Control of Generation of Code ('Code Injection'))
Exploitation prediction (EPSS)
0.20% probability of exploitation in the next 30 days (9% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Hardened Images
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb). (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.