GNOME localsearch CVE-2026-1767

Exploitation requires (1) GNOME localsearch / tracker-miners installed and the user-session tracker-extract-mp3 helper enabled (default on GNOME desktop installs of RHEL 8/9/10, Ubuntu, Debian, SUSE; absent on minimal server installs), (2) an active logged-in user session whose tracker daemon is actively indexing - hence PR:L in the CVSS vector, (3) the crafted MP3 must land in a directory monitored by tracker3 (typically ~/Music, ~/Downloads, ~/Documents, or removable media), and (4) the specific code path is the performer-tag parser inside the ID3 frame handler, so the file must contain a malformed performer frame, not just any malformed MP3. Limiting factors that reduce real-world risk: no user interaction is needed once the file lands on disk, but the attacker still needs a delivery channel into an indexed location; headless servers and non-GNOME desktops are unaffected; SSVC marks the issue Automatable: no, meaning the bug is not suitable for worm-style propagation.

Signals point in opposite directions and warrant nuance. CVSS 3.1 rates this 8.1 (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:H) - the network vector reflects that the trigger is a file the attacker chooses, not a network packet, and PR:L captures that an indexing user session must be active. EPSS at 0.19% (9th percentile), CISA SSVC marking Exploitation as 'none' and Automatable as 'no', and the absence of KEV listing all argue this is not an imminent mass-exploitation threat. The C:H assignment is defensible because heap OOB reads can leak adjacent allocations (potentially containing credentials, tokens, or ASLR-defeating pointers), but realistically the attacker still needs a delivery channel that lands the MP3 in an indexed directory of a logged-in user. Conflict to flag: AV:N is somewhat optimistic for what is operationally a local file-parsing bug - defenders should treat the realistic vector as 'user downloads or receives a malicious MP3', not 'remote unauthenticated network exploit'. Prioritize patching on multi-user desktop fleets and shared file shares; deprioritize on headless servers where localsearch is not installed.

An attacker hosts a malicious MP3 with a malformed ID3 performer frame on a download site, file share, or email attachment. A targeted user saves the file to their Downloads or Music folder; GNOME localsearch wakes up automatically, calls tracker-extract-mp3 on the new file, miscalculates the performer-frame length, and reads past the heap buffer - either crashing the extractor (DoS) or exfiltrating adjacent heap bytes (e.g., via SPARQL metadata fields the extractor writes back). No public proof-of-concept was identified at time of analysis.