CVE-2026-44604: RPM rpmuncompress RCE Vulnerability

CVE-2026-44604 Overview

CVE-2026-44604 is a command injection vulnerability in the rpmuncompress utility distributed with RPM. The tool extracts archive formats including ZIP, 7z, and GEM to a specified destination directory. During extraction, rpmuncompress inserts the archive's top-level folder name into a shell command without sanitizing shell metacharacters. An attacker who crafts an archive whose top-level folder name contains shell metacharacters can execute arbitrary commands in the context of the user running the extraction. The flaw is tracked under CWE-78 (OS Command Injection).

Critical Impact
A maliciously named archive folder can trigger arbitrary command execution as the extracting user, leading to full compromise of confidentiality, integrity, and availability on the local system.

Affected Products

RPM rpmuncompress utility (see Red Hat CVE-2026-44604 Advisory)
Distributions shipping the affected RPM tooling (refer to vendor advisories for specific package versions)
Build and packaging pipelines that invoke rpmuncompress on untrusted archives

Discovery Timeline

2026-05-28 - CVE-2026-44604 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-44604

Vulnerability Analysis

The vulnerability resides in how rpmuncompress handles ZIP, 7z, and GEM archives when a destination directory is specified. To rename or relocate the extracted contents, the utility constructs a shell command that embeds the archive's top-level folder name as a string argument. The folder name is taken directly from archive metadata and is not validated or quoted before being passed to the shell.

An attacker who controls the archive can set the top-level folder name to a string containing shell metacharacters such as `, $(), ;, |, or &&. When rpmuncompress interpolates this string into the shell command, the shell parses the metacharacters and executes the embedded payload. Execution occurs with the privileges of the user invoking the extraction, which in packaging or automation contexts may include build users or system accounts.

Root Cause

The root cause is unsanitized concatenation of attacker-controlled archive metadata into a shell command line. The code path passes the folder name through a shell interpreter rather than using a direct execve-style call with argument arrays. This is a textbook CWE-78 pattern where input boundaries between data and code are not enforced.

Attack Vector

Exploitation requires the victim to extract a crafted archive using rpmuncompress with a destination directory argument. User interaction is required, and the attack vector is local. Delivery scenarios include malicious source archives consumed by automated build systems, package rebuilds from untrusted sources, and developer workflows that extract third-party artifacts. The high attack complexity reflects the need for the target to invoke the specific extraction mode with attacker-controlled input.

No verified public proof-of-concept code is available. See the Red Hat Bug Report #2460967 for vendor-tracked technical details.

Detection Methods for CVE-2026-44604

Indicators of Compromise

Unexpected child processes spawned by rpmuncompress, particularly shells (sh, bash) executing commands unrelated to archive extraction.
Archive files containing top-level directory entries with shell metacharacters such as backticks, $(), ;, |, or && in their names.
Outbound network connections or file modifications originating from build or packaging user accounts during archive extraction tasks.

Detection Strategies

Monitor process lineage for rpmuncompress invoking /bin/sh -c with command strings containing characters from archive metadata.
Inspect archive contents prior to extraction and flag entries whose names contain non-alphanumeric shell-significant characters.
Audit build pipeline logs for extraction failures or anomalous post-extraction commands tied to RPM tooling.

Monitoring Recommendations

Enable command-line auditing (auditdexecve rules) on systems that run RPM build tooling and forward events to a centralized log store.
Alert on shell processes whose parent is rpmuncompress or RPM build helpers such as rpmbuild.
Track file integrity changes in build root directories that occur outside the expected extraction targets.

How to Mitigate CVE-2026-44604

Immediate Actions Required

Apply vendor-supplied RPM updates as soon as patched packages are published; consult the Red Hat CVE-2026-44604 Advisory for fixed package versions.
Avoid running rpmuncompress against archives from untrusted or unverified sources until patches are deployed.
Restrict build and packaging workloads to isolated, unprivileged accounts or ephemeral containers to limit blast radius.

Patch Information

Refer to the Red Hat CVE-2026-44604 Advisory and tracking record Red Hat Bug Report #2460967 for fix availability across distributions. Patched releases replace shell-based extraction with argument-array execution or sanitize archive-supplied folder names before use.

Workarounds

Validate archive contents using a separate tool (for example, unzip -l, 7z l, or gem unpack --verbose) and reject archives whose top-level entries contain shell metacharacters.
Extract untrusted archives without specifying a destination directory argument to avoid the vulnerable code path, where workflow allows.
Run extraction inside sandboxes such as bwrap, firejail, or rootless containers with no network access and minimal filesystem privileges.

bash

# Pre-extraction validation example
for entry in $(unzip -Z1 untrusted.zip | head -n 50); do
    case "$entry" in
        *[\;\|\&\`\$\(\)\<\>\"\']* )
            echo "Rejecting archive: unsafe entry name: $entry" >&2
            exit 1
            ;;
    esac
done