Every CVE Search/ Get API key

CVE-2026-1766

Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.

5.6 MediumFix available

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

0.16%Unchanged since Jun 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.6

Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Record
CVE-2026-1766
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-805
Updated
2026-11-02
EUVDEUVD-2026-37027 5.6

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Record
EUVD-2026-37027
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4x89-cjcj-2f3m 5.6

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor,...

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Record
GHSA-4x89-cjcj-2f3m
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-805
Updated
2026-11-02
NVD 5.6

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Record
CVE-2026-1766
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-805
Updated
2026-11-02
OSVDEBIAN-CVE-2026-1766 6.1

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Record
DEBIAN-CVE-2026-1766
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-1766 5.6

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Record
UBUNTU-CVE-2026-1766
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2026:10162-1 No score

localsearch-3.10.2-2.1 on GA media

These are all security issues fixed in the localsearch-3.10.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10162-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20821-1 No score

Security update for localsearch

This update for localsearch fixes the following issues:

  • CVE-2026-1764: Fixed a heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files. (bsc#1257606)
  • CVE-2026-1765: Fixed a Denial of Service and potential information disclosure via crafted MP3 files. (bsc#1257607)
  • CVE-2026-1766: Fixed a Denial of Service and information disclosure via malformed MP3 files. (bsc#1257608)
  • CVE-2026-1767: Fixed a heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags. (bsc#1257609)
Record
openSUSE-SU-2026:20821-1
Updated
2026-11-02
OSVSUSE-SU-2026:0780-1 No score

Security update for tracker-miners

This update for tracker-miners fixes the following issues:

  • CVE-2026-1764: heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files (bsc#1257606).
  • CVE-2026-1765: denial of Service and potential information disclosure via crafted MP3 files (bsc#1257607).
  • CVE-2026-1766: denial of Service and information disclosure via malformed MP3 files (bsc#1257608).
  • CVE-2026-1767: heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags (bsc#1257609).
Record
SUSE-SU-2026:0780-1
Updated
2026-11-02
OSVSUSE-SU-2026:21854-1 No score

Security update for localsearch

This update for localsearch fixes the following issues:

  • CVE-2026-1764: Fixed a heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files. (bsc#1257606)
  • CVE-2026-1765: Fixed a Denial of Service and potential information disclosure via crafted MP3 files. (bsc#1257607)
  • CVE-2026-1766: Fixed a Denial of Service and information disclosure via malformed MP3 files. (bsc#1257608)
  • CVE-2026-1767: Fixed a heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags. (bsc#1257609)
Record
SUSE-SU-2026:21854-1
Updated
2026-11-02
OSVSUSE-SU-2026:2713-1 No score

Security update for tracker

This update for tracker fixes the following issues:

  • CVE-2026-1765: heap buffer overflow vulnerability in extract_txxx_tags (bsc#1257607).
  • CVE-2026-1766: heap buffer overflow vulnerability in get_id3v23_tags (bsc#1257608).
Record
SUSE-SU-2026:2713-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
localsearch
Debian:14
 before 3.8.2-12, plus listed versions
3.8.2-103.8.2-113.8.2-53.8.2-63.8.2-73.8.2-83.8.2-9
3.8.2-12
tracker-miners
Debian:12
 All versions, plus listed versions
3.4.3-13.4.3-23.4.5-13.4.5-23.4.5-3
Show 22 moreShow less
3.4.6-13.4.6-23.4.6-33.5.0~beta-13.5.1-13.5.2-13.6.0-13.6~rc-13.7.0-13.7.1-13.7.2-13.7.3-13.7.4-13.7~beta-13.7~beta-23.7~rc-13.7~rc-23.7~rc-33.8.2-13.8.2-23.8.2-33.8.2-4
 None known
tracker-miners
Debian:13
 All versions, plus listed versions
3.8.2-4
 None known
tracker-miners
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 4 CVEs
 before 3.6.2-150600.4.6.1
3.6.2-150600.4.6.1
tracker-miners
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 4 CVEs
 before 3.6.2-150600.4.6.1
3.6.2-150600.4.6.1
tracker-miners
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 3.6.2-150600.4.6.1
3.6.2-150600.4.6.1
tracker
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 2 CVEs
 before 1.8.3-4.15.1
1.8.3-4.15.1
tracker-miners
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.2-12.0.2-1build12.0.3-12.0.4-1
 None known
tracker-miners
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.3.0-12.3.1-12.3.1-22.3.1-32.3.1-3build1
Show 5 moreShow less
2.3.1-3ubuntu12.3.3-12.3.3-22.3.3-2ubuntu0.20.04.12.3.3-2ubuntu0.20.04.2
 None known
tracker-miners
Ubuntu:22.04:LTS
 before 3.3.3-0ubuntu0.20.04.4, plus listed versions
3.1.3-13.1.3-43.3.0~beta-13.3.0~rc-13.3.0-13.3.3-0ubuntu0.20.04.13.3.3-0ubuntu0.20.04.23.3.3-0ubuntu0.20.04.3
3.3.3-0ubuntu0.20.04.4
tracker-miners
Ubuntu:24.04:LTS
 before 3.7.1-1ubuntu0.1, plus listed versions
3.4.3-23.4.5-33.4.6-13.4.6-33.7.0-13.7.1-13.7.1-1build1
3.7.1-1ubuntu0.1
tracker-miners
Ubuntu:25.10
 before 3.8.2-4ubuntu2.1, plus listed versions
3.8.2-43.8.2-4ubuntu13.8.2-4ubuntu2
3.8.2-4ubuntu2.1
localsearch
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.10.2-2.1
3.10.2-2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-1766 is a medium vulnerability (CVSS 5.6) in Gnome Localsearch, published February 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in localsearch 3.8.2-12.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open