Heap-Based Buffer Overflow Vulnerability in GNOME libgsf OLE2 Parser

CVE-2026-116124

What is CVE-2026-116124?

A security vulnerability has been identified in GNOME's libgsf, specifically within the OLE2 Parser component. The flaw resides in the ole_info_read_metabat function of gsf/gsf-infile-msole.c, which is susceptible to a heap-based buffer overflow. This vulnerability allows attackers to manipulate the application remotely, potentially leading to unauthorized memory access or execution of arbitrary code. It is crucial for users to apply the patch identified by the commit hash a8e25560b74f84c3f86df6ca0ac59195fa5af68a to mitigate the risk associated with this security issue.

References