GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTORnsfextractmethod function of plugins/nsfextractor.c.
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTORnsfeextractmethod function in plugins/nsfeextractor.c, leading to an infinite loop for a crafted size.
In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTORpngextractmethod function in plugins/pngextractor.c, related to processiTXt and stndup.
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTORxmextractmethod function in plugins/xmextractor.c.
Hello oss-security,
A stack-based buffer overflow vulnerability was identified in GNU libextractor's OLE2 plugin for versions prior to 1.15. The vulnerability has been assigned CVE-2026-91752.
Description: GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document (Denial of Service). In multi-threaded contexts using EXTRACTOROPTIONINPROCESS, the overflow bypasses -fstack-clash-protection by overflowing into adjacent thread stack frames, allowing for arbitrary Code Execution.
Affected Versions: libextractor >= 0, < 1.15
Fix: The issue is patched in GNU libextractor version 1.15.
References: CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-91752 VulnCheck Advisory: https://www.vulncheck.com/advisories/gnu-libextractor-before-1.15-stack-overflow-via-ole2 PoC & Technical Details: https://github.com/Haitam-lazaar/libextractor-ole2-rce Upstream Patches: - https://git.gnunet.org/gnunet/libextractor/commit/04004eb19033e093938138b09befdf31e71e8522.html - https://git.gnunet.org/gnunet/libextractor/commit/2781c7e9095f4ddaff4f535d69342f3903b18422.html GNU libextractor: https://www.gnu.org/software/libextractor/
Regards, Haitam Lazaar
Hello oss-security,
An untrusted search path vulnerability leading to Local Privilege Escalation (LPE) was identified in GNU libextractor for versions prior to 1.16. The vulnerability has been assigned CVE-2026-100310.
Description: GNU libextractor before 1.16 uses getenv("LIBEXTRACTORPREFIX") in src/main/extractorplugpath.c (getinstallationpaths()) to determine plugin search paths without checking whether the calling process is running with elevated privileges (setuid/setgid).
Because this environment variable is not an LD variable, the dynamic linker does not strip it from the environment of setuid binaries. A local unprivileged attacker can set LIBEXTRACTORPREFIX to a directory containing a malicious shared object, which is then loaded and executed with elevated privileges (e.g., euid=0) when any setuid application linked against libextractor runs. An attacker can call setuid(0) from within the shared library's constructor to achieve full root privilege escalation.
Affected Versions: libextractor >= 0, < 1.16
Fix: The issue is patched in GNU libextractor version 1.16.
References: CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-100310 VulnCheck Advisory: https://www.vulncheck.com/advisories/gnu-libextractor-before-1.16-privilege-escalation-via-libextractor-prefix PoC & Technical Details: https://github.com/Haitam-lazaar/libextractor-privesc Upstream Patch: https://git.gnunet.org/gnunet/libextractor/commit/6edfa653c048800e24a17f7e8cc2bb42659b8d01.html GNU libextractor: https://www.gnu.org/software/libextractor/
Regards, Haitam Lazaar
On Fri, 25 Sep 2026 at 22:26:57 +0000, Haitam Lazaar wrote: GNU libextractor before 1.16 uses getenv("LIBEXTRACTORPREFIX") in src/main/extractorplugpath.c (getinstallationpaths()) to determine plugin search paths without checking whether the calling process is running with elevated privileges (setuid/setgid).
smcv