Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Simon McVittie questions whether libextractor CVE-2026-100310 is a realistic setuid privilege escalation.
On oss-security, Simon McVittie replied about CVE-2026-100310, a claimed privilege escalation in GNU libextractor before 1.16 via the LIBEXTRACTOR_PREFIX environment variable. He asked whether the library was ever advertised as safe for setuid, setgid, or other privileged processes. Package descriptions present it as a metadata library for file-sharing networks, file managers, and web-indexing bots. He argues those are not typical setuid use cases, limiting practical impact.
- CVE-2026-100310 affects GNU libextractor before 1.16.
- Claimed issue is privilege escalation via LIBEXTRACTOR_PREFIX.
- McVittie doubts the library was meant for setuid or setgid use.
- Described uses are metadata extraction for file tools and indexing bots.
- CVEs
- CVE-2026-100310
- Vendors
- GNU
- Products
- libextractor
- Organizations
- GNU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100310 | Untrusted plugin search path in GNU libextractor | 7.3 | — |
From the original article
Posted by Simon McVittie on Sep 26 Was this library advertised as being safe for use in setuid, setgid or otherwise privileged processes? Looking at its description in my package manager ("provides developers of file-sharing networks, file managers, and WWW-indexing bots with a universal library to obtain meta-data about files") I don't immediately see why it would be appropriate for a setuid program to use this.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.