Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-84838
Red Hat Red Hat Hardened Images — Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L N R U H H H 7.8 .0111 65.2 —
AFFECTED
Product Versions Fixed
Red Hat Hardened Images unspecified 6.1.0-1.3.hum1
Red Hat Enterprise Linux 10 unspecified —
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
TIMELINE
Sep 2 Reserved by redhat
Sep 2 Published (CNA: redhat)
Oct 13 PATCH SHIPPED — CVE-2026-84838 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 6.1.0-1.3.hum1.
Description
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 2, 2026 | Reserved | Reserved by redhat |
| September 2, 2026 | Published | Published (CNA: redhat) |
| October 13, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-84838 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 6.1.0-1.3.hum1. |
Affected
Affected products and packages — 6 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat Hardened Images | — | — | 6.1.0-1.3.hum1 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-84838 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
