Red Hat Red Hat Enterprise Linux 10 Os Command Injection Permits Command Injection
Last refreshed2026-10-15
Status: UPDATED
| Advisory ID: CVE-2026-84838
Key Details
CVE
CVE-2026-84838
CVSS Score / Version
7.8 (High) / CVSS v3.1
Updated
2026-10-14
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux 10 and Red Hat Hardened Images
Classified as
CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Exploitation prediction (EPSS)
1.10% probability of exploitation in the next 30 days (65% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Hardened Images
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.