CVE-2026-1766

EUVD-2026-37027

16.06.2026, 02:16

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.6 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Affected Products (NVD)

Vendor	Product	Version
gnome	localsearch	-
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

localsearch

forky	3.11.1-3 fixed
sid	3.11.1-3 fixed

tracker-miners

bookworm	no-dsa
bullseye	postponed
trixie	no-dsa

openSUSE / SLES Releases

openSUSE Product

Release

tracker-miner-files

suse enterprise desktop 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise sap 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise server 15 SP7	3.6.2-150600.4.6.1 fixed

tracker-miners

suse enterprise desktop 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise sap 15 SP7	3.6.2-150600.4.6.1 fixed
suse enterprise server 15 SP7	3.6.2-150600.4.6.1 fixed