CVE-2026-1767CWE-805

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

Medium · published June 16, 2026

CVSS v3.1
5.6
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00246 · 14.9th percentile
Weakness
CWE-805 · Buffer Access with Incorrect Length Value
Published
2026-06-16T00:34Z
EPSS history
Timeline
  • 16 JUN 00:34Z
    Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags
    cvelistv5