# CVE-2026-91752: GNU libextractor stack-based buffer overflow in OLE2 extractor

Source: https://junglewise.ai/threats/cve-2026-91752-gnu-libextractor-stack-based-buffer-overflow-in-ole2-extractor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91752 · Severity: high · CVSS 7.5 · Published 2026-09-15

GNU libextractor is a library used to extract metadata from various file formats. A stack-based buffer overflow vulnerability in the OLE2 extractor allows attackers to craft malicious StarOffice documents that consume up to 4 MB on the stack, causing the application to crash. This can disrupt any service or tool that uses libextractor to process untrusted documents, resulting in a denial of service.

Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-91752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91752 being exploited in the wild.

**How severe is CVE-2026-91752?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** Gnu Libextractor before 1.15.

**Is there a fix for CVE-2026-91752?** A patch was published on 2026-06-29: Fixed in version 1.15; earlier patch released as 1.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91752 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-91752?** Check whether you run Gnu Libextractor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the process_star_office function within the OLE2 extractor plugin. The vulnerable code allocates a variable-length stack array (VLA) sized directly from attacker-controlled stream data, without proper bounds checking. An attacker can craft a malicious OLE2/StarOffice document with specially crafted stream metadata that causes the function to allocate up to 4 MB on the stack, triggering a stack overflow and crashing the application. The fix, implemented in version 1.15, replaces the unbounded VLA with a fixed 1024-byte stack buffer and limits the maximum readable size. The vulnerability requires the target application to process a malicious document file, but no authentication or special privileges are needed.

## Affected products

- GNU libextractor before 1.15

## Timeline

- 2026-09-15: disclosed
- 2026-06-29: patched: Fixed in version 1.15; earlier patch released as 1.14

## References

- [https://git.gnunet.org/gnunet/libextractor/commit/04004eb19033e093938138b09befdf31e71e8522.html](https://git.gnunet.org/gnunet/libextractor/commit/04004eb19033e093938138b09befdf31e71e8522.html)
- [https://git.gnunet.org/gnunet/libextractor/commit/2781c7e9095f4ddaff4f535d69342f3903b18422.html](https://git.gnunet.org/gnunet/libextractor/commit/2781c7e9095f4ddaff4f535d69342f3903b18422.html)

## Related threats

- [GNU libextractor privilege escalation via plugin search path](https://junglewise.ai/threats/cve-2026-100310-gnu-libextractor-before-1-16-loads-plugins-from-an-untrusted)