CVE-2026-1764

EUVD-2026-37025

16.06.2026, 02:16

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.6 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 11%

Affected Products (NVD)

Vendor	Product	Version
gnome	localsearch	-
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

localsearch

forky	3.11.1-3 fixed
sid	3.11.1-3 fixed

tracker-miners

bookworm	no-dsa
bullseye	2.3.5-2.1 fixed
trixie	no-dsa

openSUSE / SLES Releases

openSUSE Product

Release

tracker-miner-files

suse enterprise desktop 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise sap 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise server 15 SP4	3.2.2-150400.3.10.1 fixed
suse enterprise server 15 SP7	3.6.2-150600.4.6.1 fixed

tracker-miners

suse enterprise desktop 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise sap 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise server 15 SP4	3.2.2-150400.3.10.1 fixed
suse enterprise server 15 SP7	3.6.2-150600.4.6.1 fixed

tracker-miners-lang

suse enterprise desktop 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise sap 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise server 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise workstation 15 SP7	3.6.2-150600.4.6.1 fixed