Executive brief
GNOME localsearch (formerly tracker-miners) is a search engine and metadata extractor used in many Linux desktop environments to index files. A vulnerability in its MP3 processing component allows a specially crafted music file to crash the indexing service or potentially expose fragments of system memory. This could lead to a persistent denial-of-service where the search tool repeatedly crashes when attempting to process the malicious file.
Technical details
A heap buffer overflow (OOB Read) exists in the 'get_id3v23_tags' function within 'src/extractor/tracker-extract-mp3.c'. The vulnerability is triggered when processing ID3v2.3 COMM (Comment) tags. The extractor incorrectly calculates buffer offsets without verifying if the offset exceeds the frame size ('csize'), leading to an integer underflow when calculating the length passed to 'id3v2_text_to_utf8'. This results in 'g_convert' performing an out-of-bounds read. An attacker can exploit this by providing a malformed MP3 file, causing a SIGSEGV (Denial of Service) or leaking heap memory.
Affected products
- GNOME localsearch (tracker-miners) unspecified
Timeline
- 2026-02-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-16: advisory: CVE published to NVD