GNU libextractor CVE-2026-91752

Exploitation requires that the target application calls GNU libextractor on a file controlled by the attacker. The vulnerable code path is only reached when the file is parsed as a StarOffice/OLE2 compound document - files of other formats do not trigger process_star_office. No authentication is required (PR:N) and no user interaction beyond the application's normal file-processing workflow is needed; automated pipelines (indexers, mail processors, content management systems) are therefore fully exploitable without any human action. Exploitation is limited to a process crash (DoS); there is no evidence of a code execution primitive. Systems that do not process StarOffice-format documents with libextractor are not exposed.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) accurately reflects the network-reachability and low-complexity nature of this vulnerability: any pipeline or application that automatically ingests files and calls libextractor for metadata parsing is exploitable simply by submitting a crafted StarOffice document. EPSS data was not supplied; however, the existence of a named public exploit repository (Haitam-lazaar/libextractor-ole2-rce) raises effective exploitation likelihood above the baseline for unpatched deployments. The practical impact is denial-of-service - a crash, not code execution - which moderates urgency compared to RCE-class findings despite the high score; even a mid-sized municipal IT team in opole running automated document indexing pipelines would still need to prioritize patching, since repeated crashes constitute a reliable service disruption primitive. KEV status is absent, suggesting no confirmed widespread exploitation yet. The absence of Confidentiality or Integrity impact (VC:N/VI:N in the 4.0 vector) is corroborated by the nature of a VLA stack overflow: the process terminates before any useful memory disclosure or write-what-where primitive is established. No conflicting signals are present between the CVSS vector and the description.

An attacker uploads or emails a specially crafted StarOffice (.sds, .sdw, or similar) OLE2 document to a target system running an automated metadata extraction pipeline (e.g., a file search indexer or document management system) that uses libextractor. When the pipeline calls libextractor's metadata extraction routines, process_star_office reads the attacker-supplied stream length field and allocates a VLA of that size on the stack, immediately exhausting stack space and crashing the worker process. A publicly available proof-of-concept repository (github.com/Haitam-lazaar/libextractor-ole2-rce) demonstrates this crash primitive, making reliable reproduction trivial for any attacker who can submit a file to such a pipeline.