AZL-105329
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105329.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-105329
- Upstream
- CVE-2026-95519
- Published
- 2026-09-24T14:18:20Z
- Modified
- 2026-10-03T05:35:10Z
- Summary
- CVE-2026-95519 affecting package rpm 4.18.2-2
- Details
-
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using
rpm -q -por similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of therpmprocess. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. - References