Skip to main content

GNOME localsearch CVE-2026-1766

| EUVDEUVD-2026-37027 MEDIUM
Buffer Access with Incorrect Length Value (CWE-805)
2026-06-16 fedora GHSA-4x89-cjcj-2f3m
Denial Of Service Buffer Overflow Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9
6.1
CVSS 3.1 · NVD
Share

Severity by source

Vendor (fedora) PRIMARY
MEDIUM
qualitative
NVD
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI
5.6 MEDIUM

Local file-based trigger requires low-privilege local account and indexer processing (UI:R); crash causes high availability loss with incidental heap read (C:L) and no write primitive.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Ubuntu
MEDIUM
qualitative
SUSE
5.6 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Red Hat
5.6 MEDIUM
qualitative

Primary rating from Vendor (fedora).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

2
CVSS changed
Jun 16, 2026 - 20:37 NVD
5.6 (MEDIUM) 6.1 (MEDIUM)
Analysis Generated
Jun 16, 2026 - 02:17 vuln.today

DescriptionNVD

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

AnalysisAI

Heap buffer overflow in GNOME localsearch's tracker-extract-mp3 component enables a local attacker to crash the metadata extraction daemon and potentially disclose heap memory contents by supplying a specially crafted MP3 file with malformed ID3v2.3 COMM tags. Affected platforms confirmed by Red Hat include RHEL 8, 9, and 10, where GNOME localsearch (formerly tracker-miners) runs as a background desktop search indexing service. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; exploitation is further constrained by the requirement for local access, low privileges, and user interaction.

Technical ContextAI

GNOME localsearch, rebranded from tracker-miners, provides a metadata extraction framework for the GNOME desktop search subsystem. The tracker-extract-mp3 component parses ID3 tags embedded in MP3 audio files to feed metadata into the searchable index. ID3v2.3 COMM frames carry multi-language comment fields with an explicit length prefix; CWE-805 (Buffer Access with Incorrect Length Value) indicates that the code uses an attacker-controlled or malformed length value from the COMM frame header to perform a heap write operation without adequate bounds verification, resulting in a heap buffer overflow. CPE data pins the vulnerable software to Red Hat Enterprise Linux 8, 9, and 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_*), confirming this is a packaging and distribution-level concern rather than a narrow upstream edge case. The daemon typically runs under the user session and auto-processes files placed in monitored directories.

RemediationAI

Patch availability is confirmed per vendor advisory at https://access.redhat.com/security/cve/CVE-2026-1766 and the associated Bugzilla tracking entry at https://bugzilla.redhat.com/show_bug.cgi?id=2435982; however, the exact fixed package version is not specified in the available data and should be obtained from Red Hat directly before deploying. Apply available RHEL errata for the localsearch or tracker-miners package via standard dnf/yum update mechanisms. As a compensating control where patching is not immediately possible, administrators can disable GNOME localsearch auto-indexing via 'gsettings set org.freedesktop.Tracker3.Miner.Files enable-monitors false' or by stopping the tracker-miner-fs-3 systemd user service - note this disables desktop search functionality as a trade-off. Alternatively, removing or restricting untrusted MP3 files from directories monitored by the indexer (typically the user home directory) eliminates the attack surface without fully disabling the service.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

Same weakness CWE-805 – Buffer Access with Incorrect Length Value

View all
CVE-2024-24851 HIGH POC
7.5
CVE-2020-14509 CRITICAL
9.8
CVE-2021-3581 HIGH
8.8
CVE-2025-30651 HIGH
8.7
CVE-2026-1837 HIGH
8.7
CVE-2026-1767 HIGH
8.1
CVE-2026-53016 HIGH
7.8
CVE-2025-20175 HIGH
7.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
localsearch
Release Status Version
resolute not-affected 3.8.2-12
jammy DNE -
noble DNE -
questing DNE -
upstream released 3.11
tracker-miners
Release Status Version
resolute DNE -
jammy released 3.3.3-0ubuntu0.20.04.4
noble released 3.7.1-1ubuntu0.1
bionic needed -
focal needed -
upstream released 3.11
questing released 3.8.2-4ubuntu2.1
USN-8019-1

Debian

Bug #1126910
localsearch
Release Status Fixed Version Urgency
forky, sid fixed 3.11.1-3 -
(unstable) fixed 3.8.2-12 -
tracker-miners
Release Status Fixed Version Urgency
bullseye vulnerable 2.3.5-2.1 -
bookworm vulnerable 3.4.3-1 -
trixie vulnerable 3.8.2-4 -
(unstable) fixed (unfixed) -

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed
openSUSE Leap 15.6 Fixed

Share

CVE-2026-1766 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy