libextractor-privesc

CVE-2026-100310: LIBEXTRACTORPREFIX を介した GNU libextractor の権限昇格 概要 GNU libextractor のプラグイン読み込み機構は、LIBEXTRACTORPREFIX 環境変数を使用して共有ライブラリ.so プラグインを読み込む場所を決定します。securegetenv ではなく getenv を使用しているため、プロセスが昇格した権限で実行されている場合でもこの環境変数は除去されません。攻撃者は LIBEXTRACTORPREFIX を悪意のあるディレクトリに設定し、libextractor...

libextractor-ole2-rce

CVE-2026-91752: GNU libextractor における OLE2 経由のスタックオーバーフロー 概要 GNU libextractor の OLE2 プラグインにおけるスタックベースのバッファオーバーフローにより、細工された .doc ファイルを処理する際にリモートサービス拒否 （クラッシュ）およびコード実行 が可能になります。この脆弱性は processstaroffice（ole2extractor.c:349）に存在し、攻撃者が制御するファイルデータに基づいて最大 4MB の可変長配列（VLA）をスタック上に確保します。 主要な影響: リモートサービス拒否 —...

SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310

A flaw was found in libextractor. When executed by privileged applications, such as those running with elevated set user ID setuid permissions, the library loads plugins from an untrusted search path defined by the LIBEXTRACTORPREFIX environment variable without verifying caller privileges. A loc...

Linux Distros Unpatched Vulnerability : CVE-2026-100310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege check...

DEBIAN-CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

UBUNTU-CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310 GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310 GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

EUVD-2026-87314

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310

The GNU libextractor library (versions

CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310: Untrusted Search Path

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

PT-2026-99099

Name of the Vulnerable Software and Affected Versions GNU libextractor versions prior to 1.16 Description The software loads plugins from an untrusted search path defined by the LIBEXTRACTOR PREFIX environment variable without performing proper privilege checks. A local attacker can manipulate th...

CVE-2026-91752

A flaw was found in libextractor. This stack-based buffer overflow vulnerability in the processstaroffice function allows attackers to craft malicious StarOffice documents. When processed, these documents can cause a large allocation on the stack, leading to a stack overflow and crashing any...

CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

DEBIAN-CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

UBUNTU-CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...