https://seclists.org/oss-sec/2026/q3/959: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PFIX
Published Sep 26, 2026
·Updated
Affected Software
1 affected component
GNU Libextractor<1.16
Deployments using GNU libextractor versions before 1.16 are exposed when libextractor is invoked by a process running with elevated setuid or setgid privileges.
The attacker needs to be able to influence the LIBEXTRACTOR_PREFIX environment variable seen by the elevated process. The vulnerable code uses that variable to determine plugin search paths without checking for elevated execution.
Identify systems running GNU libextractor before 1.16, then determine whether any setuid or setgid applications invoke it. Such applications should be treated as potentially affected if their environment can contain LIBEXTRACTOR_PREFIX.