CVE-2026-91752
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
Risk Assessment
Risk of application crash (DoS) when processing malicious documents, potentially disrupting services.
Recommendation
Upgrade libextractor to version 1.15 or later and restrict processing of untrusted documents.
Other vulnerabilities in GNU libextractor
See all- CVE-2026-100310High
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
- CVE-2017-15602High
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.
- CVE-2017-15601High
In GNU Libextractor version 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt and stndup.
- CVE-2017-15600High
In GNU Libextractor version 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.
- CVE-2017-15267High
In GNU Libextractor version 1.4, there is a NULL Pointer Dereference in the flac_metadata function in flac_extractor.c.
Original NVD description (English source)
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS