CVE-2026-1765
Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
- Record
CVE-2026-1765- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-37026
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
- Record
EUVD-2026-37026- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c2w3-xj42-mrvr
A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as...
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
- Record
GHSA-c2w3-xj42-mrvr- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
- Record
CVE-2026-1765- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-1765
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
- Record
DEBIAN-CVE-2026-1765- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-1765
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
- Record
UBUNTU-CVE-2026-1765- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2026:10162-1 No score
localsearch-3.10.2-2.1 on GA media
These are all security issues fixed in the localsearch-3.10.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10162-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20821-1 No score
Security update for localsearch
This update for localsearch fixes the following issues:
- CVE-2026-1764: Fixed a heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files. (bsc#1257606)
- CVE-2026-1765: Fixed a Denial of Service and potential information disclosure via crafted MP3 files. (bsc#1257607)
- CVE-2026-1766: Fixed a Denial of Service and information disclosure via malformed MP3 files. (bsc#1257608)
- CVE-2026-1767: Fixed a heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags. (bsc#1257609)
- Record
openSUSE-SU-2026:20821-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0780-1 No score
Security update for tracker-miners
This update for tracker-miners fixes the following issues:
- CVE-2026-1764: heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files (bsc#1257606).
- CVE-2026-1765: denial of Service and potential information disclosure via crafted MP3 files (bsc#1257607).
- CVE-2026-1766: denial of Service and information disclosure via malformed MP3 files (bsc#1257608).
- CVE-2026-1767: heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags (bsc#1257609).
- Record
SUSE-SU-2026:0780-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21854-1 No score
Security update for localsearch
This update for localsearch fixes the following issues:
- CVE-2026-1764: Fixed a heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files. (bsc#1257606)
- CVE-2026-1765: Fixed a Denial of Service and potential information disclosure via crafted MP3 files. (bsc#1257607)
- CVE-2026-1766: Fixed a Denial of Service and information disclosure via malformed MP3 files. (bsc#1257608)
- CVE-2026-1767: Fixed a heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags. (bsc#1257609)
- Record
SUSE-SU-2026:21854-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2713-1 No score
Security update for tracker
This update for tracker fixes the following issues:
- CVE-2026-1765: heap buffer overflow vulnerability in
extract_txxx_tags(bsc#1257607). - CVE-2026-1766: heap buffer overflow vulnerability in
get_id3v23_tags(bsc#1257608).
- Record
SUSE-SU-2026:2713-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
localsearchDebian:14 |
before 3.8.2-12, plus listed versions 3.8.2-103.8.2-113.8.2-53.8.2-63.8.2-73.8.2-83.8.2-9 |
3.8.2-12 |
tracker-minersDebian:12 |
All versions, plus listed versions 3.4.3-13.4.3-23.4.5-13.4.5-23.4.5-3 Show 22 moreShow less3.4.6-13.4.6-23.4.6-33.5.0~beta-13.5.1-13.5.2-13.6.0-13.6~rc-13.7.0-13.7.1-13.7.2-13.7.3-13.7.4-13.7~beta-13.7~beta-23.7~rc-13.7~rc-23.7~rc-33.8.2-13.8.2-23.8.2-33.8.2-4 |
None known |
tracker-minersDebian:13 |
All versions, plus listed versions 3.8.2-4 |
None known |
tracker-minersSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 4 CVEs |
before 3.6.2-150600.4.6.1 | 3.6.2-150600.4.6.1 |
tracker-minersSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 4 CVEs |
before 3.6.2-150600.4.6.1 | 3.6.2-150600.4.6.1 |
tracker-minersopenSUSE:Leap 15.6 From an advisory covering 4 CVEs |
before 3.6.2-150600.4.6.1 | 3.6.2-150600.4.6.1 |
trackerSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 1.8.3-4.15.1 | 1.8.3-4.15.1 |
tracker-minersUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.2-12.0.2-1build12.0.3-12.0.4-1 |
None known |
tracker-minersUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.0-12.3.1-12.3.1-22.3.1-32.3.1-3build1 Show 5 moreShow less2.3.1-3ubuntu12.3.3-12.3.3-22.3.3-2ubuntu0.20.04.12.3.3-2ubuntu0.20.04.2 |
None known |
tracker-minersUbuntu:22.04:LTS |
before 3.3.3-0ubuntu0.20.04.4, plus listed versions 3.1.3-13.1.3-43.3.0~beta-13.3.0~rc-13.3.0-13.3.3-0ubuntu0.20.04.13.3.3-0ubuntu0.20.04.23.3.3-0ubuntu0.20.04.3 |
3.3.3-0ubuntu0.20.04.4 |
tracker-minersUbuntu:24.04:LTS |
before 3.7.1-1ubuntu0.1, plus listed versions 3.4.3-23.4.5-33.4.6-13.4.6-33.7.0-13.7.1-13.7.1-1build1 |
3.7.1-1ubuntu0.1 |
tracker-minersUbuntu:25.10 |
before 3.8.2-4ubuntu2.1, plus listed versions 3.8.2-43.8.2-4ubuntu13.8.2-4ubuntu2 |
3.8.2-4ubuntu2.1 |
localsearchopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 3.10.2-2.1 | 3.10.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-1765 is a medium vulnerability (CVSS 5.6) in Red Hat Enterprise Linux 10, published February 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in localsearch 3.8.2-12.
References
access.redhat.com/security/cve/CVE-2026-1765
bugzilla.redhat.com/show_bug.cgi?id=2435981
nvd.nist.gov/vuln/detail/CVE-2026-1765
github.com/advisories/GHSA-c2w3-xj42-mrvr
security-tracker.debian.org/tracker/CVE-2026-1765
suse.com/support/update/announcement/2026/suse-su-20260780-1
Show 13 moreShow less
bugzilla.suse.com/1257606
ubuntu.com/security/CVE-2026-1765
cve.org/CVERecord?id=CVE-2026-1765