Vendor
A local command injection vulnerability (CVE-2026-84233) in the rpm utility allows execution of arbitrary commands when rpmuncompress processes maliciously crafted filenames containing RPM macro syntax.