Full Report
GNU security advisory (AV26-923)
Analysis Summary
# Vulnerability: GNU libextractor Stack Overflow via OLE2
## CVE Details
- **CVE ID:** CVE-2026-91752
- **CVSS Score:** Not explicitly listed in advisory (Typically High/Critical for RCE-capable stack overflows)
- **CWE:** CWE-121 (Stack-based Buffer Overflow)
## Affected Systems
- **Products:** GNU libextractor (a library used to extract metadata from files of arbitrary type)
- **Versions:** All versions prior to v1.15
- **Configurations:** Systems utilizing libextractor to parse OLE2 (Object Linking and Embedding) containers, often found in legacy Microsoft Office documents.
## Vulnerability Description
A stack-based buffer overflow exists in the OLE2 parser within `libextractor`. The flaw is triggered when the library processes a specially crafted OLE2 file. Due to insufficient boundary checking during the parsing of the OLE2 directory structure or streams, an attacker can overwrite the stack memory. This can lead to a crash (Denial of Service) or potential Arbitrary Code Execution (RCE) in the context of the application using the library.
## Exploitation
- **Status:** PoC available (referenced via external researcher repository)
- **Complexity:** Medium
- **Attack Vector:** Local/Remote (The vector is technically "Local" or "Network" depending on how the application employs the library, such as an automated file scanner or a file manager previewer).
## Impact
- **Confidentiality:** High (Potential for data exfiltration if RCE is achieved)
- **Integrity:** High (Potential for unauthorized system changes)
- **Availability:** High (Application crash or system instability)
## Remediation
### Patches
- **libextractor v1.15:** Users should upgrade to version 1.15 or later.
- **Commit Fix:** A specific patch has been applied to the gnunet/libextractor repository (Commit: `2781c7e9095f4ddaff4f535d69342f3903b18422`).
### Workarounds
- **Disable OLE2 Parsing:** If upgrading is not immediately possible, consider disabling the OLE2 plugin within libextractor configurations if that file format is not required for your workflow.
- **Untrusted Files:** Avoid using libextractor on untrusted or unsolicited documents from unknown sources.
## Detection
- **Indicators of Compromise:** Segmentation faults or unexpected crashes of services utilizing `libextractor` (e.g., file indexers, metadata extractors).
- **Detection Methods:** Static analysis of the `libextractor` binary to check for versioning; use of YARA rules to detect malformed OLE2 headers designed to trigger stack overflows.
## References
- GNU Project: hxxps[://]www[.]gnu[.]org/software/libextractor/
- GNU Source Commit: hxxps[://]git[.]gnunet[.]org/gnunet/libextractor/commit/2781c7e9095f4ddaff4f535d69342f3903b18422[.]html
- Researcher PoC: hxxps[://]github[.]com/Haitam-lazaar/libextractor-ole2-rce#cve-2026-91752-gnu-libextractor-stack-overflow-via-ole2
- Canadian Centre for Cyber Security Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/gnu-security-advisory-av26-923