Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-95520: Red Hat Enterprise Linux rpm can run malicious package code

CVE-2026-95520 · published 1 month ago

Summary

The rpm utility in Red Hat Enterprise Linux versions 6 through 10 can be tricked by a specially crafted package to execute attacker-controlled code. This happens when the tool processes a malicious archive, potentially allowing a hacker to take control of the system. Apply the latest security updates from Red Hat or avoid installing untrusted RPM packages to protect your servers.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	red hat	red hat enterprise linux 10	All versions
–	red hat	red hat enterprise linux 6	All versions
–	red hat	red hat enterprise linux 7	All versions
–	red hat	red hat enterprise linux 8	All versions
–	red hat	red hat enterprise linux 9	All versions
–	red hat	red hat hardened images	All versions
Debian:12	debian	rpm	All versions
Ubuntu:Pro:14.04:LTS	canonical	rpm	All versions

Original advisory text

DEBIAN-CVE-2026-95520

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2537809 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-95520 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-95520 Vendor Advisory
https://ubuntu.com/security/CVE-2026-95520 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-95520 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published29 Sep 2026

Updated26 Oct 2026

First seen29 Sep 2026

Sources

CVE-2026-95520 · NVD

CVE-2026-95520 · MITRE

DEBIAN-CVE-2026-95520 · OSV

UBUNTU-CVE-2026-95520 · OSV

Track software like this

Free during beta