# CVE-2026-100310: GNU libextractor privilege escalation via plugin search path

Source: https://junglewise.ai/threats/cve-2026-100310-gnu-libextractor-before-1-16-loads-plugins-from-an-untrusted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100310 · Severity: high · CVSS 7 · Published 2026-09-25

GNU libextractor is a metadata extraction library used by applications to identify file types and extract information. Before version 1.16, the library loads plugins from directories specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. An attacker with local access can exploit this to execute arbitrary code with elevated privileges by placing a malicious plugin in a directory they control and having a setuid or setgid application load it.

Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-100310 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100310 being exploited in the wild.

**How severe is CVE-2026-100310?** High severity, with a CVSS score of 7, published 25 September 2026.

**Which products and versions are affected?** Gnu Libextractor before 1.16.

**Is there a fix for CVE-2026-100310?** A patch was published on 2026-06-30: Fixed in version 1.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100310 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-100310?** Check whether you run Gnu Libextractor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in libextractor's plugin loading mechanism, which respects the LIBEXTRACTOR_PREFIX environment variable even when the calling process is setuid/setgid or running with elevated privileges. An attacker can set LIBEXTRACTOR_PREFIX to point to a directory containing a malicious plugin that gets loaded and executed with the privileges of the setuid/setgid program. Version 1.16 and later disable the use of LIBEXTRACTOR_PREFIX in privileged contexts (setuid/setgid or running as root).

## Affected products

- GNU libextractor before 1.16

## Timeline

- 2026-09-25: disclosed
- 2026-06-30: patched: Fixed in version 1.16

## References

- [https://ftp.gnu.org/gnu/libextractor/](https://ftp.gnu.org/gnu/libextractor/)
- [https://git.gnunet.org/gnunet/libextractor/commit/6edfa653c048800e24a17f7e8cc2bb42659b8d01.html](https://git.gnunet.org/gnunet/libextractor/commit/6edfa653c048800e24a17f7e8cc2bb42659b8d01.html)

## Related threats

- [GNU libextractor stack-based buffer overflow in OLE2 extractor](https://junglewise.ai/threats/cve-2026-91752-gnu-libextractor-stack-based-buffer-overflow-in-ole2-extractor)