CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow (CWE-789, memory allocation with an excessive size value) in the process_star_office function, which sizes a variable-length stack array from attacker-controlled OLE2 stream data. An attacker crafts a malicious StarOffice-format document; when any libextractor-based application extracts its metadata, the parser can be driven to allocate up to 4 MB on the stack, overflowing it and crashing the process. The CVSS 4.0 score of 8.7 reflects a network attack vector with no privileges, no user interaction, and availability-only impact (VA:H, VC:N/VI:N), so the demonstrated effect is denial of service rather than code execution. Any product or service that links libextractor before 1.15 and extracts metadata from untrusted documents — for example file-indexing, search, or upload-scanning services — is affected. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade to GNU libextractor 1.15 or later, and audit whether applications that embed the library (file managers, search indexers, upload-scanning services, GNUnet) link a version before 1.15. If patching is delayed, restrict or sandbox metadata extraction of untrusted StarOffice/legacy OLE2-based documents, for example by running extraction in a separate memory-limited worker process so a crash cannot take down the parent service. Monitor metadata-extraction pipelines for crashes on OLE2/StarOffice documents as a possible indicator of attempted exploitation.