Executive brief
GNU libextractor is a library used to extract metadata from various file formats. A stack-based buffer overflow vulnerability in the OLE2 extractor allows attackers to craft malicious StarOffice documents that consume up to 4 MB on the stack, causing the application to crash. This can disrupt any service or tool that uses libextractor to process untrusted documents, resulting in a denial of service.
Technical details
The vulnerability exists in the process_star_office function within the OLE2 extractor plugin. The vulnerable code allocates a variable-length stack array (VLA) sized directly from attacker-controlled stream data, without proper bounds checking. An attacker can craft a malicious OLE2/StarOffice document with specially crafted stream metadata that causes the function to allocate up to 4 MB on the stack, triggering a stack overflow and crashing the application. The fix, implemented in version 1.15, replaces the unbounded VLA with a fixed 1024-byte stack buffer and limits the maximum readable size. The vulnerability requires the target application to process a malicious document file, but no authentication or special privileges are needed.
Affected products
- GNU libextractor before 1.15
Timeline
- 2026-09-15: disclosed
- 2026-06-29: patched: Fixed in version 1.15; earlier patch released as 1.14