8.7
High
CVE-2026-91752 GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function…
Description
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libextractor 1.15 | earliest → < 1.15 | 1.15 |
References
- github.com github.com
- git.gnunet.org git.gnunet.org
- git.gnunet.org git.gnunet.org
- www.gnu.org www.gnu.org
- VulnCheck Advisory: GNU libextractor before 1.15 Stack Overflow via OLE2 www.vulncheck.com
Timeline
- Published
- Last modified