Vulnerability-Lookup

OPENSUSE-SU-2026:10162-1

Vulnerability from csaf_opensuse - Published: 2026-02-07 00:00 - Updated: 2026-09-17 16:53

Summary

localsearch-3.10.2-2.1 on GA media

Severity

Moderate

Notes

Title of the patch: localsearch-3.10.2-2.1 on GA media

Description of the patch: These are all security issues fixed in the localsearch-3.10.2-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10162

CVE-2026-1764

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-1765

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-1764

Threats

Impact moderate

CVE-2026-1766

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-1764

Threats

Impact moderate

CVE-2026-1767

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-1764

Threats

Impact moderate

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-1764/	self
https://www.suse.com/security/cve/CVE-2026-1765/	self
https://www.suse.com/security/cve/CVE-2026-1766/	self
https://www.suse.com/security/cve/CVE-2026-1767/	self
https://www.suse.com/security/cve/CVE-2026-1764	external
https://bugzilla.suse.com/1257606	external
https://www.suse.com/security/cve/CVE-2026-1765	external
https://bugzilla.suse.com/1257607	external
https://www.suse.com/security/cve/CVE-2026-1766	external
https://bugzilla.suse.com/1257608	external
https://www.suse.com/security/cve/CVE-2026-1767	external
https://bugzilla.suse.com/1257609	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "localsearch-3.10.2-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the localsearch-3.10.2-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10162",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10162-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1764 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1764/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1765 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1765/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1766 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1766/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1767 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1767/"
      }
    ],
    "title": "localsearch-3.10.2-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T16:53:03Z",
      "generator": {
        "date": "2026-02-07T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10162-1",
      "initial_release_date": "2026-02-07T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-02-07T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:59:06Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:01:20Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T16:53:03Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "localsearch-0:3.10.2-2.1.aarch64",
                "product": {
                  "name": "localsearch-0:3.10.2-2.1.aarch64",
                  "product_id": "localsearch-0:3.10.2-2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch@3.10.2-2.1?arch=aarch64\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "localsearch-lang-0:3.10.2-2.1.aarch64",
                "product": {
                  "name": "localsearch-lang-0:3.10.2-2.1.aarch64",
                  "product_id": "localsearch-lang-0:3.10.2-2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch-lang@3.10.2-2.1?arch=aarch64\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "localsearch-0:3.10.2-2.1.ppc64le",
                "product": {
                  "name": "localsearch-0:3.10.2-2.1.ppc64le",
                  "product_id": "localsearch-0:3.10.2-2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch@3.10.2-2.1?arch=ppc64le\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "localsearch-lang-0:3.10.2-2.1.ppc64le",
                "product": {
                  "name": "localsearch-lang-0:3.10.2-2.1.ppc64le",
                  "product_id": "localsearch-lang-0:3.10.2-2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch-lang@3.10.2-2.1?arch=ppc64le\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "localsearch-0:3.10.2-2.1.s390x",
                "product": {
                  "name": "localsearch-0:3.10.2-2.1.s390x",
                  "product_id": "localsearch-0:3.10.2-2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch@3.10.2-2.1?arch=s390x\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "localsearch-lang-0:3.10.2-2.1.s390x",
                "product": {
                  "name": "localsearch-lang-0:3.10.2-2.1.s390x",
                  "product_id": "localsearch-lang-0:3.10.2-2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch-lang@3.10.2-2.1?arch=s390x\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "localsearch-0:3.10.2-2.1.x86_64",
                "product": {
                  "name": "localsearch-0:3.10.2-2.1.x86_64",
                  "product_id": "localsearch-0:3.10.2-2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch@3.10.2-2.1?arch=x86_64\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "localsearch-lang-0:3.10.2-2.1.x86_64",
                "product": {
                  "name": "localsearch-lang-0:3.10.2-2.1.x86_64",
                  "product_id": "localsearch-lang-0:3.10.2-2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/localsearch-lang@3.10.2-2.1?arch=x86_64\u0026upstream=localsearch-0:3.10.2-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-0:3.10.2-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64"
        },
        "product_reference": "localsearch-0:3.10.2-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-0:3.10.2-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le"
        },
        "product_reference": "localsearch-0:3.10.2-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-0:3.10.2-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x"
        },
        "product_reference": "localsearch-0:3.10.2-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-0:3.10.2-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64"
        },
        "product_reference": "localsearch-0:3.10.2-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-lang-0:3.10.2-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64"
        },
        "product_reference": "localsearch-lang-0:3.10.2-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-lang-0:3.10.2-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le"
        },
        "product_reference": "localsearch-lang-0:3.10.2-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-lang-0:3.10.2-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x"
        },
        "product_reference": "localsearch-lang-0:3.10.2-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "localsearch-lang-0:3.10.2-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
        },
        "product_reference": "localsearch-lang-0:3.10.2-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1764",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1764"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1764",
          "url": "https://www.suse.com/security/cve/CVE-2026-1764"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257606 for CVE-2026-1764",
          "url": "https://bugzilla.suse.com/1257606"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-1764"
    },
    {
      "cve": "CVE-2026-1765",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1765"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system\u0027s memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1765",
          "url": "https://www.suse.com/security/cve/CVE-2026-1765"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257607 for CVE-2026-1765",
          "url": "https://bugzilla.suse.com/1257607"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-1765"
    },
    {
      "cve": "CVE-2026-1766",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1766"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1766",
          "url": "https://www.suse.com/security/cve/CVE-2026-1766"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257608 for CVE-2026-1766",
          "url": "https://bugzilla.suse.com/1257608"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-1766"
    },
    {
      "cve": "CVE-2026-1767",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1767"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
          "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1767",
          "url": "https://www.suse.com/security/cve/CVE-2026-1767"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257609 for CVE-2026-1767",
          "url": "https://bugzilla.suse.com/1257609"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-0:3.10.2-2.1.x86_64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.aarch64",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.ppc64le",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.s390x",
            "openSUSE Tumbleweed:localsearch-lang-0:3.10.2-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-07T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-1767"
    }
  ]
}

CVE-2026-1764 (GCVE-0-2026-1764)

Vulnerability from cvelistv5 – Published: 2026-06-16 00:32 – Updated: 2026-06-16 14:56

Title

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 files

Summary

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 14:56 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

fedora redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-1764	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2435980	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-02-02 11:11

Credits

Red Hat would like to thank Fatih Çelik for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:56:27.321271Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T14:56:55.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fatih \u00c7elik for reporting this issue."
        }
      ],
      "datePublic": "2026-02-02T11:11:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T00:32:34.371Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1764"
        },
        {
          "name": "RHBZ#2435980",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435980"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-02T14:47:22.621Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-02T11:11:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 files",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-1764",
    "datePublished": "2026-06-16T00:32:34.371Z",
    "dateReserved": "2026-02-02T14:56:26.038Z",
    "dateUpdated": "2026-06-16T14:56:55.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1765 (GCVE-0-2026-1765)

Vulnerability from cvelistv5 – Published: 2026-06-16 00:34 – Updated: 2026-06-16 14:59

Title

Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files

Summary

A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 14:58 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

fedora redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-1765	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2435981	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-02-02 11:11

Credits

Red Hat would like to thank Fatih Çelik for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:58:49.885220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T14:59:02.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fatih \u00c7elik for reporting this issue."
        }
      ],
      "datePublic": "2026-02-02T11:11:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system\u0027s memory."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T00:34:27.855Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1765"
        },
        {
          "name": "RHBZ#2435981",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435981"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-02T14:49:38.979Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-02T11:11:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-1765",
    "datePublished": "2026-06-16T00:34:27.855Z",
    "dateReserved": "2026-02-02T14:57:06.163Z",
    "dateUpdated": "2026-06-16T14:59:02.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1766 (GCVE-0-2026-1766)

Vulnerability from cvelistv5 – Published: 2026-06-16 00:34 – Updated: 2026-06-16 14:58

Title

Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.

Summary

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 14:57 UTC

CWE

CWE-805 - Buffer Access with Incorrect Length Value

Assigner

fedora redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-1766	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2435982	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-02-02 11:11

Credits

Red Hat would like to thank Fatih Çelik for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:57:47.072293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T14:58:07.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fatih \u00c7elik for reporting this issue."
        }
      ],
      "datePublic": "2026-02-02T11:11:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-805",
              "description": "Buffer Access with Incorrect Length Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T00:34:39.044Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1766"
        },
        {
          "name": "RHBZ#2435982",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435982"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-02T14:51:08.941Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-02T11:11:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-805: Buffer Access with Incorrect Length Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-1766",
    "datePublished": "2026-06-16T00:34:39.044Z",
    "dateReserved": "2026-02-02T14:57:38.934Z",
    "dateUpdated": "2026-06-16T14:58:07.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1767 (GCVE-0-2026-1767)

Vulnerability from cvelistv5 – Published: 2026-06-16 00:34 – Updated: 2026-06-16 14:57

Title

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

Summary

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 14:57 UTC

CWE

CWE-805 - Buffer Access with Incorrect Length Value

Assigner

fedora redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-1767	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2435983	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-02-02 11:11

Credits

Red Hat would like to thank Fatih Çelik for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:57:14.008147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T14:57:34.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "tracker-miners",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fatih \u00c7elik for reporting this issue."
        }
      ],
      "datePublic": "2026-02-02T11:11:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-805",
              "description": "Buffer Access with Incorrect Length Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T00:34:48.539Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1767"
        },
        {
          "name": "RHBZ#2435983",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435983"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-02T14:52:09.553Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-02T11:11:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-805: Buffer Access with Incorrect Length Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-1767",
    "datePublished": "2026-06-16T00:34:48.539Z",
    "dateReserved": "2026-02-02T14:58:36.144Z",
    "dateUpdated": "2026-06-16T14:57:34.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:10162-1

CVE-2026-1764 (GCVE-0-2026-1764)

CVE-2026-1765 (GCVE-0-2026-1765)

CVE-2026-1766 (GCVE-0-2026-1766)

CVE-2026-1767 (GCVE-0-2026-1767)

Tags

Sightings

Nomenclature

Related by attack behaviour