GNOME localsearch CVE-2026-1766

Exploitation requires a local account on the affected system with at least low privilege (PR:L per CVSS). The attacker must be able to write a malicious MP3 file to a location monitored by GNOME localsearch, which by default includes the user home directory tree. GNOME localsearch must be installed and running as a user-session service - it is enabled by default on GNOME desktop deployments of RHEL but may not be present on server or minimal installations. The malformed content must specifically target the ID3v2.3 COMM (Comment) tag parser within tracker-extract-mp3. User interaction (UI:R) is technically required, but in practice the indexer may auto-process newly written files without explicit user action beyond placing the file. Exploitation is limited to systems running a GNOME desktop environment with tracker-extract-mp3 active; headless or server RHEL deployments without GNOME are not affected. The attack vector is strictly local (AV:L), ruling out remote network exploitation absent additional file-delivery primitives.

The NVD CVSS 3.1 base score of 5.6 (Medium) reflects the combined constraints of a local attack vector (AV:L), low privilege requirement (PR:L), and mandatory user interaction (UI:R), all of which substantially limit opportunistic exploitation. The high availability impact (A:H) drives the score upward but is offset by the unchanged scope (S:U) and low confidentiality impact (C:L), with no integrity impact (I:N). The C:L component reflects secondary heap memory disclosure - a meaningful but not primary concern. EPSS data was not provided, so exploitation probability cannot be quantified; however, the absence of a KEV listing and any reported POC, combined with the local-only attack vector, suggests low real-world exploitation pressure. This is not a high-urgency emergency patch but warrants remediation in standard patch cycles, particularly on multi-user RHEL systems where less-trusted local users could plant malicious MP3 files in shared or auto-indexed directories. The UI:R flag is operationally important: exploitation requires the indexer to process the file, which may happen automatically when a file is placed in a watched directory - this subtly reduces the effective UI barrier beyond what the vector alone implies.

An attacker with a local user account on an affected RHEL system places a specially crafted MP3 file containing a malformed ID3v2.3 COMM tag into a directory monitored by the GNOME localsearch indexer, such as the user's home or music directory. The tracker-extract-mp3 daemon automatically processes the file during background indexing, triggering the heap buffer overflow, which crashes the process and may expose heap memory contents to the attacker through crash artifacts or error output. No public proof-of-concept code has been identified, so crafting a working exploit requires independent ID3v2.3 parsing research.