Quick answers
- Is CVE-2026-1767 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-1767 being exploited in the wild.
- How severe is CVE-2026-1767?
- Medium severity, with a CVSS score of 5.6, published 16 June 2026.
- Which products and versions are affected?
- Gnome Localsearch unspecified.
- Is there a fix for CVE-2026-1767?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-1767 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-1767?
- Check whether you run Gnome Localsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer overflow (out-of-bounds read) exists in the `extract_performers_tags` function within `src/extractor/tracker-extract-mp3.c` of GNOME localsearch. The vulnerability is caused by an incorrect length calculation when parsing performer tags in MP3 files with malformed ID3 tags. Specifically, the code passes an incorrect remaining buffer size to the UTF-8 conversion functions, allowing `iconv` to read past the allocated memory. An attacker can exploit this by providing a crafted MP3 file, leading to a process crash (SIGSEGV) or the disclosure of sensitive heap data. The attack requires the user to interact with the file (e.g., downloading it to a monitored directory) so that the local indexing service attempts to extract its metadata.
Affected products
- GNOME localsearch (tracker-miners) unspecified
Timeline
- 2026-02-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-16: advisory: CVE published to NVD