Heap Buffer Overflow in GNOME Localsearch MP3 Extractor Affects Red Hat
CVE-2026-1764

5.6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
16 June 2026

What is CVE-2026-1764?

A vulnerability was identified in GNOME localsearch's MP3 Extractor that arises when processing specially crafted MP3 files with ID3v2.4 tags. This flaw lies in the extract_performers_tags function, where a missing bounds check can result in a heap buffer overflow. Exploiting this issue may allow remote attackers to cause a Denial of Service (DoS) by prompting the system to read unmapped memory. Furthermore, it could also enable information disclosure through the visibility of heap data, raising concerns about the security and privacy of user information.

References

https://access.redhat.com/security/cve/CVE-2026-1764
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2435980
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Fatih Çelik for reporting this issue.
.