CVE-2026-100310: GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU libextractorto a version that resolves this vulnerability.Fixed in 1.16
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when a setuid or setgid program uses GNU libextractor before 1.16 and can load its plugins while honoring the LIBEXTRACTOR_PREFIX environment variable. The attacker must already have local access.
What does an attacker need to exploit it?
An attacker needs to set LIBEXTRACTOR_PREFIX to a directory they control and place a malicious plugin there. A vulnerable setuid or setgid program must then load that plugin.
Are ordinary non-privileged uses of GNU libextractor affected in the same way?
The described privilege-escalation scenario depends on a setuid or setgid program loading the attacker-controlled plugin. The provided information does not identify an equivalent elevated-privilege impact for ordinary non-privileged executions.