GNOME libgsf CVE-2026-116124

Exploitation requires a victim to open or process a crafted OLE2 compound-document file in an application that uses libgsf's OLE2 parser; the flaw is in ole_info_read_metabat in gsf/gsf-infile-msole.c (metadata/BAT parsing path). The limiting factor is the required passive user interaction (UI:P) - the malicious file must be opened/previewed - so there is no fully unattended remote trigger. Affected versions are libgsf up to 1.14.60; no authentication is required (PR:N). The specific malformed-structure trigger is not described in the available sources.

This is a moderate-priority issue, not an emergency. The vendor CVSS 4.0 score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, meaning no privileges are required but passive user interaction (UI:P) is - a victim must open or process a malicious file - and the vulnerable-system impact is rated Low across confidentiality, integrity, and availability with no scope change. The exploit-maturity metric is E:X (Not Defined), and no EPSS score, no CISA KEV listing, and no confirmed working exploit code were supplied, so there is no public evidence of active or imminent exploitation. The vuln.today Decision label is 'this_month', which aligns with the medium severity and the absence of exploitation signals: remediate in the normal patch cycle rather than as an emergency. Caveat: this entry originates from VulDB and the impact metrics are rated Low, but a heap-based buffer overflow (CWE-122) in a file parser can in principle have higher impact than the Low ratings suggest; the available sources do not describe the trigger mechanism or demonstrated impact beyond 'heap-based buffer overflow', so the real-world severity ceiling is not independently verifiable from this data.

An attacker crafts a malicious OLE2 (Microsoft compound document) file and delivers it by email, download, or a shared location; when a victim opens or previews it in an application that uses libgsf to parse OLE2 content, the ole_info_read_metabat function overflows a heap buffer. Because the CVSS vector requires passive user interaction (UI:P), exploitation depends on the victim processing the file. No public exploit code is identified in the provided data; a VulDB submission reference exists but is not verified as working exploit code.