GNOME localsearch CVE-2026-1764

Exploitation requires that the target system runs GNOME localsearch (tracker-miners) with MP3 metadata extraction enabled, which is the default configuration on GNOME-based RHEL desktops. The attacker must be able to deliver a crafted MP3 file to the local filesystem of the target (AV:L). A low-privileged local user account is required (PR:L) - no administrative or root access is needed to trigger indexing. Critically, user interaction is required (UI:R): the victim must perform an action that causes localsearch to process the malicious file, such as opening a file manager in a directory containing the file, playing the file in a media application, or having automatic indexing enabled on a watched directory. Exploitation is not possible purely remotely without a file delivery mechanism. Systems running headless RHEL without GNOME or with tracker indexing disabled are not affected.

The CVSS 3.1 score of 5.6 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), and mandatory user interaction (UI:R) - all of which substantially constrain real-world exploitability. An attacker cannot reach the vulnerable parsing path over the network directly; they must first convince a local user to receive and trigger indexing of a malicious MP3 file, either via email attachment, file share, or USB media. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, making opportunistic mass exploitation unlikely. The primary realistic risk is DoS (application crash) rather than code execution - the CWE-125 out-of-bounds read class rarely leads to reliable control-flow hijacking. The partial information disclosure (C:L) is bounded to heap data visible at the time of the read and requires favorable heap layout conditions. Overall, this is a genuine but low-urgency finding best addressed through standard patch cycles.

An attacker crafts an MP3 file embedding a malformed ID3v2.4 frame with an oversized length field in the performer tag and delivers it to a target RHEL user via email, file share, or removable media. When the user opens a file manager or music application that triggers GNOME localsearch to index the file, the extract_performers_tags function reads beyond the heap buffer, crashing the tracker-extract process (DoS) or in favorable heap conditions leaking adjacent heap contents. No public POC has been identified, so this scenario currently requires custom exploit development.