CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor before 1.16 can be locally escalated via the LIBEXTRACTOR_PREFIX search path.
An untrusted search path flaw, CVE-2026-100310, affects GNU libextractor versions before 1.16. The library uses getenv("LIBEXTRACTOR_PREFIX") in extractor_plugpath.c to choose plugin search paths without verifying the calling process. Controlling that variable can redirect plugin loading and enable local privilege escalation. The report does not describe observed exploitation.
- CVE-2026-100310 is a local privilege escalation in libextractor before 1.16
- Plugin paths are taken from LIBEXTRACTOR_PREFIX without caller checks
- The flaw is in get_installation_paths() in extractor_plugpath.c
- No in-the-wild exploitation is reported
- CVEs
- CVE-2026-100310
- Vendors
- GNU
- Products
- GNU libextractor
- Organizations
- GNU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100310 | Untrusted plugin search path in GNU libextractor | 7.3 | — |
From the original article
Posted by Haitam Lazaar on Sep 25 Hello oss-security, An untrusted search path vulnerability leading to Local Privilege Escalation (LPE) was identified in GNU libextractor for versions prior to 1. 16. The vulnerability has been assigned CVE-2026-100310.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.