EIP-2026-102978

This exploit leverages a vulnerability in Red Star OS's Software Manager (swmng.app), which runs as root and installs unsigned RPM packages. By tricking a user into installing a malicious RPM, an attacker can gain root access via a root shell.