CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2
GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.
A stack-based buffer overflow was identified in GNU libextractor's OLE2 plugin in versions prior to 1.15, assigned CVE-2026-91752. The flaw resides in the process_star_office function, which sizes a variable-length stack array using attacker-controlled OLE2 stream data. Attackers can craft malicious OLE2/StarOffice files to trigger the overflow. The issue was disclosed on the oss-security mailing list by researcher Haitam Lazaar on September 16, 2026.
- Stack-based buffer overflow in libextractor's OLE2 plugin affects versions before 1.15
- Vulnerability is in process_star_office, which sizes a stack array from attacker-controlled stream data
- Assigned CVE-2026-91752; fixed in GNU libextractor 1.15
- Disclosed publicly on the oss-security mailing list by Haitam Lazaar
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-91752 | Stack Overflow DoS in GNU libextractor StarOffice Parser (pre-1.15) GNU libextractor before 1.15 contains a stack-based buffer overflow (CWE-789, memory allocation with an excessive size value) in the process_star_office function, which sizes a variable-length stack array from attacker-controlled OLE2 stream data. An attacker crafts a malicious StarOffice-format document; when any libextractor-based application extracts its metadata, the parser can be driven to allocate up to 4 MB on the stack, overflowing it and crashing the process. The CVSS 4.0 score of 8.7 reflects a network attack vector with no privileges, no user interaction, and availability-only impact (VA:H, VC:N/VI:N), so the demonstrated effect is denial of service rather than code execution. Any product or service that links libextractor before 1.15 and extracts metadata from untrusted documents — for example file-indexing, search, or upload-scanning services — is affected. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported. Do: Upgrade to GNU libextractor 1.15 or later, and audit whether applications that embed the library (file managers, search indexers, upload-scanning services, GNUnet) link a version before 1.15. If patching is delayed, restrict or sandbox metadata extraction of untrusted StarOffice/legacy OLE2-based documents, for example by running extraction in a separate memory-limited worker process so a crash cannot take down the parent service. Monitor metadata-extraction pipelines for crashes on OLE2/StarOffice documents as a possible indicator of attempted exploitation. | 8.7 | — |
| niche≈low tens of thousands of installations at most (order of magnitude) |
Posted by Haitam Lazaar on Sep 16 Hello oss-security, A stack-based buffer overflow vulnerability was identified in GNU libextractor's OLE2 plugin for versions prior to 1.15. The vulnerability has been assigned CVE-2026-91752. Description: GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the `process_star_office` function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious...
This source does not provide full text. Read it at seclists.org.