https://seclists.org/oss-sec/2026/q3/959: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PFIX

Q: Which deployments are exposed to privilege escalation?

Deployments using GNU libextractor versions before 1.16 are exposed when libextractor is invoked by a process running with elevated setuid or setgid privileges.

Q: What does an attacker need to exploit this issue?

The attacker needs to be able to influence the LIBEXTRACTOR_PREFIX environment variable seen by the elevated process. The vulnerable code uses that variable to determine plugin search paths without checking for elevated execution.

Q: How can I identify potentially affected systems?

Identify systems running GNU libextractor before 1.16, then determine whether any setuid or setgid applications invoke it. Such applications should be treated as potentially affected if their environment can contain LIBEXTRACTOR_PREFIX.

Published Sep 26, 2026

Updated

Affected Software

1 affected component

GNU Libextractor<1.16

Frequently Asked Questions

Which deployments are exposed to privilege escalation?

Deployments using GNU libextractor versions before 1.16 are exposed when libextractor is invoked by a process running with elevated setuid or setgid privileges.

What does an attacker need to exploit this issue?

The attacker needs to be able to influence the LIBEXTRACTOR_PREFIX environment variable seen by the elevated process. The vulnerable code uses that variable to determine plugin search paths without checking for elevated execution.

How can I identify potentially affected systems?

Identify systems running GNU libextractor before 1.16, then determine whether any setuid or setgid applications invoke it. Such applications should be treated as potentially affected if their environment can contain LIBEXTRACTOR_PREFIX.