CVE-2026-100310

GNU libextractor before 1.16 loads plugins from a directory given by the LIBEXTRACTOR_PREFIX environment variable without checking whether the process is running with elevated privileges. A local attacker who can set that variable can point it at a directory containing a malicious plugin. When a setuid or setgid program then loads libextractor, the plugin runs as arbitrary code with the program's elevated privileges. The issue affects systems that ship vulnerable libextractor and use it from privileged binaries; ordinary unprivileged use does not by itself yield escalation. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade GNU libextractor to 1.16 or later on every host that ships it. Until then, do not run setuid or setgid programs that load libextractor, and prevent untrusted users from setting LIBEXTRACTOR_PREFIX for those processes. Inventory setuid/setgid binaries and confirm whether they link libextractor.