CVE-2006-2458
Libextractor multiple heap-based buffer overflows
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
Exploit likelihood
What each source reports
NVD Score used
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
CVE-2006-2458- CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
CVE-2006-2458- Updated
- 2026-11-02
EUVDEUVD-2006-0008 No score
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
EUVD-2006-0008- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f836-7jqw-3684 No score
Libextractor multiple heap-based buffer overflows
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
GHSA-f836-7jqw-3684- Updated
- 2026-11-02
OSV No score
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
CVE-2006-2458- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2458 No score
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
DEBIAN-CVE-2006-2458- Updated
- 2026-11-02
OSVGHSA-f836-7jqw-3684 No score
Libextractor multiple heap-based buffer overflows
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
GHSA-f836-7jqw-3684- Updated
- 2026-11-02
OSVPYSEC-2006-4 No score
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
- Record
PYSEC-2006-4- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
extractorPyPI |
0.5 to 0.5 | None known |
libextractorDebian:12 |
before 0.5.14-1 | 0.5.14-1 |
libextractorDebian:13 |
before 0.5.14-1 | 0.5.14-1 |
libextractorDebian:14 |
before 0.5.14-1 | 0.5.14-1 |
libextractorDebian:3.1 |
before 0.4.2-2sarge5, plus listed versions 0.4.2-20.4.2-2sarge10.4.2-2sarge20.4.2-2sarge30.4.2-2sarge4 |
0.4.2-2sarge5 |
extractorPyPI |
Listed versions 0.5 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | libextractor 0.5.13 - Multiple Heap Overflows (PoC) | 2006-05-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2458 is a medium vulnerability (CVSS 4.0) in Libextractor, published May 18, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.21%, the 95th percentile. Fixed in libextractor 0.5.14-1.
References
securityfocus.com/archive/1/434288/100/0/threaded
securitytracker.com/id?1016118
novell.com/linux/security/advisories/2006-06-02.html
securityreason.com/securityalert/916
secunia.com/advisories/20160
Show 13 moreShow less
debian.org/security/2006/dsa-1081
gnunet.org/libextractor
exchange.xforce.ibmcloud.com/vulnerabilities/26531
gentoo.org/security/en/glsa/glsa-200605-14.xml
vupen.com/english/advisories/2006/1848
nvd.nist.gov/vuln/detail/CVE-2006-2458
github.com/pypa/advisory-database/tree/main/vulns/extractor/PYSEC-2006-4.yaml
security-tracker.debian.org/tracker/CVE-2006-2458