GNOME localsearch EUVD-2026-37026

Exploitation requires that the GNOME localsearch (tracker-miners) indexing service is running on the target system, which is the default configuration on GNOME desktop environments including RHEL 8/9/10 workstation installations. The malicious MP3 file must be placed in a filesystem directory monitored by the tracker daemon (typically the user's home directory or removable media mount points) OR opened by a user in a context that triggers extraction. The CVSS vector specifies PR:L (low privilege required) and UI:R (user interaction required), meaning a local user account is needed and the file must be processed by the indexer - automatic indexing of downloaded files satisfies the UI:R condition without explicit user intent. Exploitation is limited to the user session running the tracker-extract process and does not cross privilege boundaries (S:U, scope unchanged). Non-GNOME or headless server deployments without tracker-miners installed are not affected.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H) yields a base score of 5.6 (Medium). The local attack vector and required user interaction substantially constrain exploitability relative to network-reachable vulnerabilities. However, the CVE description states 'a remote attacker could exploit this by providing a malicious MP3 file' - this apparent conflict with AV:L is worth clarifying: the attacker may deliver the file remotely (email, download, shared storage), but the actual parsing and crash occur locally via the tracker daemon. CISA KEV status is negative and no POC has been identified, so exploitation status is 'no public exploit identified at time of analysis.' EPSS data was not provided; given the local vector, limited privilege escalation potential, and Medium CVSS, real-world priority is low for most enterprise environments unless GNOME desktop indexing is broadly deployed and the attack surface for malicious file delivery is uncontrolled. The primary risk is DoS (indexer crash) rather than meaningful data exfiltration, as memory leaks from CWE-125 conditions are typically shallow and unpredictable in yield.

An attacker crafts a malicious MP3 file with a specially constructed ID3 tag or audio frame that triggers an out-of-bounds read when parsed by tracker-extract-mp3. The attacker delivers the file to the target system via email attachment, a shared network drive, or a web download. When the GNOME localsearch daemon automatically indexes the newly arrived file - or when the user manually opens it - tracker-extract-mp3 processes the file, the out-of-bounds read triggers an application crash causing a denial of service, and heap memory contents adjacent to the buffer may be exposed in crash dumps or through timing side channels. No public exploit code exists at time of analysis.