libextractor vulnerabilities

2 known vulnerabilities in libextractor from GNU. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  libextractor: Untrusted Search Path

  CVE-2026-100310Sep 25, 2026GNU

  GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a mal

• 7.5 High severity

  libextractor: Memory Allocation with Excessive Size Value

  CVE-2026-91752Sep 15, 2026GNU

  GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that al