Skip to content
Threat Feed

Tag

CVE-2026-44604

1 brief RSS
high advisory

CVE-2026-44604: RPM rpmuncompress Command Injection Vulnerability

A command injection vulnerability (CVE-2026-44604) exists in the `rpmuncompress` utility of RPM; when extracting specially crafted ZIP, 7z, or GEM archives, an attacker can inject shell commands via a malicious top-level folder name, leading to arbitrary code execution as the user running the extraction.

RPM command-injection CVE-2026-44604 archive-extraction linux
2r 1t 1c