AZL-111103: CVE-2026-116124 affecting package libgsf 1.14.47-2

Q: What input would an attacker need to exploit this issue?

An attacker would need to cause the affected OLE2 parser to process crafted content that reaches the ole_info_read_metabat function in gsf/gsf-infile-msole.c. The vulnerability is described as remotely exploitable.

Q: Which libgsf versions are affected?

GNOME libgsf versions up to 1.14.60 are identified as affected. The listed package is libgsf 1.14.47-2.

Q: What is the remediation?

Apply the vendor patch identified as a8e25560b74f84c3f86df6ca0ac59195fa5af68a. No alternative mitigation is provided in the available data.

Published Oct 26, 2026

Updated

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function oleinforeadmetabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.

Affected Software

1 affected component

azure-linux/libgsf<=1.14.47-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch a8e25560b74f84c3f86df6ca0ac59195fa5af68a

Event History

Oct 26, 2026

Advisory Published

via OSV·07:17 AM

Data Sourced

via OSV·07:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116124

Frequently Asked Questions

What input would an attacker need to exploit this issue?

An attacker would need to cause the affected OLE2 parser to process crafted content that reaches the ole_info_read_metabat function in gsf/gsf-infile-msole.c. The vulnerability is described as remotely exploitable.

Which libgsf versions are affected?

GNOME libgsf versions up to 1.14.60 are identified as affected. The listed package is libgsf 1.14.47-2.

What is the remediation?

Apply the vendor patch identified as a8e25560b74f84c3f86df6ca0ac59195fa5af68a. No alternative mitigation is provided in the available data.

AZL-111103: CVE-2026-116124 affecting package libgsf 1.14.47-2

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What input would an attacker need to exploit this issue?

Which libgsf versions are affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

What input would an attacker need to exploit this issue?

Which libgsf versions are affected?

What is the remediation?