CVE-2026-1764

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.

Score
CVSS 3.1 5.6 Medium
Status
Analyzed - patrick@puiterwijk.org
Published
2026-06-16
Last modified
2026-06-16
Weaknesses
CWE-125

Affected products

References

 
 
© AVABIS GmbH privacypolicy about