CVE-2026-91752: GNU libextractor before 1.15 Stack Overflow via OLE2
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Any application that uses GNU libextractor before 1.15 to extract metadata from untrusted StarOffice documents is exposed. The vulnerable code processes attacker-controlled OLE2 stream data.
What must an attacker do to trigger the issue?
An attacker must provide a crafted StarOffice document containing malicious OLE2 stream data. No privileges or user interaction are indicated by the supplied CVSS vector.
What is the expected impact?
The crafted stream can cause libextractor to allocate up to 4 MB on the stack, leading to a stack overflow and crash of the application performing metadata extraction. The provided impact information indicates availability impact only.
How can I determine whether an installation is affected?
Check the GNU libextractor version used by the metadata-extracting application. Versions before 1.15 are affected when they process StarOffice OLE2 documents.