Attack Chain

1. An attacker crafts a malicious ZIP, 7z, or GEM archive. The archive’s top-level folder name contains shell metacharacters (e.g., ;, |, &).
2. A user is tricked into using the rpmuncompress utility or a similar tool that leverages it to extract the malicious archive to a specified destination directory.
3. rpmuncompress processes the archive and extracts the top-level folder name.
4. Due to insufficient sanitization, the crafted folder name containing shell metacharacters is incorporated into a shell command.
5. The shell command is executed by the system, interpreting the metacharacters as command separators or modifiers.
6. The injected commands execute arbitrary code within the context of the user running rpmuncompress.
7. The attacker gains control of the system or performs unauthorized actions.
8. The attacker achieves their objective, such as data exfiltration, installing malware, or creating new privileged accounts.

Impact

Successful exploitation of CVE-2026-44604 allows an attacker to execute arbitrary commands on the affected system with the privileges of the user running the rpmuncompress utility. This can lead to complete system compromise, data theft, or denial of service. The CVSS v3.1 base score is 7.0, indicating a high severity. Given the widespread use of RPM in Linux distributions, this vulnerability poses a significant risk to a large number of systems.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM to detect command injection attempts using shell metacharacters within archive names.
• Where feasible, avoid using rpmuncompress on untrusted archives. If archive extraction is necessary, isolate the process in a sandboxed environment to limit the impact of potential command injection.
• Apply patches or updates provided by Red Hat that address CVE-2026-44604.
• Monitor process creation events for unusual commands being executed by rpmuncompress or related processes, as identified by the Sigma rules.