{
  "cveId": "CVE-2026-95519",
  "url": "https://patchblox.com/security/cve/CVE-2026-95519",
  "summary": "CVE-2026-95519 is fixed in 33 products on 1 platform, first by ALAS2023-2026-3398, released November 10, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Rpm: code execution via macro expansion of manifest entries in \u0060rpmgi\u0060 (\u0060-q -p\u0060 / verify manifest flows)",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-95519:\n\tA flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using \u0060rpm -q -p\u0060 or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the \u0060rpm\u0060 process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.\n\nCVE-2026-84837:\n\tA flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by \u0060rpmbuild -t*\u0060 to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.\n\nCVE-2026-103242:\n\tA heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package\u0027s main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag\u0027s attacker-controlled, hex-decoded content -- of attacker-chosen length -- past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.",
  "published": "2026-10-01T01:26:05Z",
  "severity": "Important",
  "cvss": 7.8,
  "cwe": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
  "epss": 0.00144,
  "epssPercentile": 0.03705,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95519",
  "fixes": [
    {
      "platform": "linux",
      "product": "python3-rpm",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "python3-rpm-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-apidocs",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-build",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-build-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-build-libs",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-build-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-cron",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-devel",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-devel-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-libs",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-audit",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-audit-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-fapolicyd",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-fapolicyd-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-ima",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-ima-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-prioreset",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-prioreset-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-selinux",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-selinux-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-syslog",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-syslog-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-systemd-inhibit",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-plugin-systemd-inhibit-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-sign",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-sign-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-sign-libs",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    },
    {
      "platform": "linux",
      "product": "rpm-sign-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "4.16.1.3-29.amzn2023.0.9",
      "fix": "ALAS2023-2026-3398",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3398",
      "released": "2026-11-10T03:55:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}