Macro Injection Vulnerability in rpmbuild (CVE-2026-78367)

CVE-2026-78367 is a macro injection vulnerability in rpmbuild, a utility commonly used within Red Hat Enterprise Linux (RHEL) environments to build RPM packages. When rpmbuild operates in tarball mode and processes a specially crafted tarball, an attacker can leverage malicious tar member names to trigger macro injection. Successful exploitation results in arbitrary code execution on the target system.

The attack requires user interaction, specifically convincing a user to perform an rpmbuild operation on a malicious archive. Given that rpmbuild is frequently used by developers, build engineers, and system administrators, the impact is highest in environments where external or untrusted source tarballs are processed during CI/CD or package maintenance workflows. The vulnerability is tracked as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Impact

The vulnerability carries a CVSS 3.1 score of 7.0. If exploited, an attacker can gain the same level of access as the user running the rpmbuild command. This can lead to full system compromise, exfiltration of source code or environment credentials, and persistent backdooring of build environments. Targeted sectors include any organization relying on RHEL-based distributions for software development or infrastructure management.

Recommendation

Prioritize patching systems where rpmbuild is active in automated build pipelines.

• Review and restrict the use of untrusted source tarballs in automated build environments.
• Apply security patches provided by Red Hat for RHEL 7, 8, 9, and 10 as soon as they are made available via official channels.
• Audit build logs for suspicious file names or macro characters within tarball member names.