AI analysis
GNU libextractor before 1.15 contains a stack-based buffer overflow (CWE-789, memory allocation with an excessive size value) in the process_star_office function, which sizes a variable-length stack array from attacker-controlled OLE2 stream data. An attacker crafts a malicious StarOffice-format document; when any libextractor-based application extracts its metadata, the parser can be driven to allocate up to 4 MB on the stack, overflowing it and crashing the process. The CVSS 4.0 score of 8.7 reflects a network attack vector with no privileges, no user interaction, and availability-only impact (VA:H, VC:N/VI:N), so the demonstrated effect is denial of service rather than code execution. Any product or service that links libextractor before 1.15 and extracts metadata from untrusted documents — for example file-indexing, search, or upload-scanning services — is affected. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.
What to do: Upgrade to GNU libextractor 1.15 or later, and audit whether applications that embed the library (file managers, search indexers, upload-scanning services, GNUnet) link a version before 1.15. If patching is delayed, restrict or sandbox metadata extraction of untrusted StarOffice/legacy OLE2-based documents, for example by running extraction in a separate memory-limited worker process so a crash cannot take down the parent service. Monitor metadata-extraction pipelines for crashes on OLE2/StarOffice documents as a possible indicator of attempted exploitation.
Affected
| GNU libextractor | before 1.15 |
Estimated exposure
niche≈low tens of thousands of installations at most (order of magnitude) — libextractor is a niche GNU metadata-extraction library packaged in major Linux distributions and consumed mainly by projects like GNUnet and desktop file-indexing tools; no public scan data or active-install counts exist for…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.