https://seclists.org/oss-sec/2026/q3/957: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PFIX

Q: Who is realistically exposed to exploitation?

Systems with GNU libextractor versions before 1.16 are exposed when a setuid or setgid application linked against libextractor runs in an attacker-controlled environment. The attacker must have local access and be able to run that elevated application.

Q: What does an attacker need to exploit this issue?

An unprivileged local attacker needs to set LIBEXTRACTOR_PREFIX to a directory containing a malicious shared object. When a setuid application linked against the vulnerable library runs, libextractor can load that object with the application's elevated privileges.

Q: How can I determine whether a system is affected?

Check whether the installed GNU libextractor version is earlier than 1.16, and identify setuid or setgid applications linked against it. Such applications may be exploitable if they execute while retaining the LIBEXTRACTOR_PREFIX environment variable.

Q: What should be done if patching is not immediately possible?

Prevent elevated applications linked against libextractor from running with LIBEXTRACTOR_PREFIX present in their environment. Restrict access to any affected setuid or setgid applications until GNU libextractor can be updated to version 1.16.

Published Sep 25, 2026

Updated

Affected Software

1 affected component

GNU Libextractor<1.16

Frequently Asked Questions

Who is realistically exposed to exploitation?

Systems with GNU libextractor versions before 1.16 are exposed when a setuid or setgid application linked against libextractor runs in an attacker-controlled environment. The attacker must have local access and be able to run that elevated application.

What does an attacker need to exploit this issue?

An unprivileged local attacker needs to set LIBEXTRACTOR_PREFIX to a directory containing a malicious shared object. When a setuid application linked against the vulnerable library runs, libextractor can load that object with the application's elevated privileges.

How can I determine whether a system is affected?

Check whether the installed GNU libextractor version is earlier than 1.16, and identify setuid or setgid applications linked against it. Such applications may be exploitable if they execute while retaining the LIBEXTRACTOR_PREFIX environment variable.

What should be done if patching is not immediately possible?

Prevent elevated applications linked against libextractor from running with LIBEXTRACTOR_PREFIX present in their environment. Restrict access to any affected setuid or setgid applications until GNU libextractor can be updated to version 1.16.