GNU libextractor CVE-2026-100310

Requires local low-privileged access to the host AND the presence of a setuid or setgid program that uses GNU libextractor (before 1.16) to load plugins; the attacker sets the LIBEXTRACTOR_PREFIX environment variable to a directory containing a malicious plugin, which the vulnerable library loads from that untrusted search path without privilege checks. Limiting factors: exploitation is local-only (no network vector), depends on a suitable setuid/setgid consumer actually being installed and invocable, and is prevented on hosts running the patched 1.16 release; no user interaction by a victim is needed.

This is a genuine but conditionally-gated local privilege-escalation issue, not a remote-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, base 7.3) is internally consistent with the description: exploitation is LOCAL (AV:L), requires an already-present low-privileged foothold (PR:L), and carries an Attack Requirement (AT:P) that reflects a real prerequisite - a setuid or setgid program that links libextractor must exist on the host, or the untrusted-search-path load never runs with elevated privileges. Where signals disagree, the divergence favors caution: a public POC exists (VulnCheck / github.com/Haitam-lazaar/libextractor-privesc), which raises practical exploitability, but there is no EPSS score and no CISA KEV listing, so this is publicly-demonstrable rather than confirmed actively exploited or mass-scanned. The 'RCE' tag overstates reach - with AV:L this is local arbitrary code execution / privesc, NOT remotely triggerable code execution, and defenders should not triage it as internet-exposed RCE. Net: real priority only for multi-user hosts that ship a setuid/setgid consumer of libextractor; otherwise moderate. The high VC/VI/VA:H impact is credible (code runs as root/elevated) but is only reachable after the setuid-consumer precondition is met.

A local unprivileged user on a shared host points LIBEXTRACTOR_PREFIX at a directory holding a malicious extractor plugin, then invokes a setuid/setgid binary that uses libextractor to read file metadata; the library loads the attacker's plugin from the untrusted path and executes its code with the binary's elevated privileges, yielding root/group escalation. A public proof-of-concept for this exact LIBEXTRACTOR_PREFIX privesc is available, lowering the skill barrier. The attack is local-only and hinges on the presence of such a setuid/setgid consumer.