CVE-2014-8118: Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CP...

Security readout for executives and security teams

CVE-2014-8118 is a flaw in RPM 4.12 and earlier. A specially crafted RPM package can trigger memory corruption while RPM reads the package payload, with possible arbitrary code execution. Business risk is highest where users, automation, or build systems process RPMs from untrusted or weakly controlled sources. Likely exposed assets include systems running RPM 4.12 or earlier, plus packaging, CI, repository mirroring, and administrative workflows that inspect or install RPM files. Distribution advisories suggest affected RPM packages existed across multiple Linux ecosystems, but exact downstream version ranges must be checked per vendor. Prioritize remediation where RPM packages are processed automatically or sourced externally. This is an older vulnerability, but arbitrary code execution in package handling can affect privileged systems and software supply-chain workflows. No active exploitation evidence is provided in the bundle. Mitigation focus: Identify systems and workflows using RPM 4.12 or earlier.; Apply vendor RPM security updates from the relevant Linux distribution.; Restrict package intake to trusted repositories and verified sources..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.