ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Story · 2 sources · 2 articlesfirst updated ()

GNU libextractor stack-based buffer overflow via OLE2 (CVE-2026-91752), fixed in version 1.15

mediumVulnerabilityimportance 45CVE-2026-91752
What's new: First merged summary (no previous version). Consolidates the Canadian Cyber Centre advisory AV26-923 (2026-09-15) with the subsequent oss-security disclosure (2026-09-16), adding the technical root cause (stack array sized in process_star_office from attacker-controlled stream data), the researcher attribution (Haitam Lazaar), and the fixed version (1.15).
Merged summary · glm-5.3-flash · rewritten as coverage arrives

GNU libextractor before version 1.15 contains a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser's process_star_office function, triggerable via crafted OLE2/StarOffice files; the flaw was disclosed on oss-security by researcher Haitam Lazaar…

The Canadian Centre for Cyber Security issued advisory AV26-923 on September 15, 2026, covering CVE-2026-91752, a stack-based buffer overflow in GNU libextractor versions prior to 1.15 triggered via OLE2 file parsing. A public disclosure followed on the oss-security mailing list on September 16, 2026, by researcher Haitam Lazaar, which detailed the root cause: the vulnerability resides in the process_star_office function, which sizes a variable-length stack array using attacker-controlled OLE2 stream data. Attackers can craft malicious OLE2/StarOffice files to trigger the overflow. The issue is fixed in GNU libextractor 1.15, and the Cyber Centre encourages users and administrators to review the advisory links and apply necessary updates.

  • CVE-2026-91752 is a stack-based buffer overflow in GNU libextractor's OLE2 plugin
  • Affected versions: GNU libextractor prior to 1.15; fixed in GNU libextractor 1.15
  • Vulnerable function: process_star_office, which sizes a variable-length stack array from attacker-controlled OLE2 stream data
  • Exploitation path: crafted malicious OLE2/StarOffice files trigger the overflow
  • Disclosed publicly on the oss-security mailing list by researcher Haitam Lazaar on September 16, 2026
  • Canadian Centre for Cyber Security advisory AV26-923 issued September 15, 2026
  • Cyber Centre advises users and administrators to review advisory links and apply updates as they become available
VendorsGNU
Productslibextractor
OrganizationsGNU

Coverage timeline

  1. · 1d ago
    Canadian Centre for Cyber Security· 15
    GNU security advisory (AV26-923)

    Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.

  2. · 4h ago
    oss-security· 45
    CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2

    GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.

Vulnerabilities in this storyAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2026-91752
Stack Overflow DoS in GNU libextractor StarOffice Parser (pre-1.15)

GNU libextractor before 1.15 contains a stack-based buffer overflow (CWE-789, memory allocation with an excessive size value) in the process_star_office function, which sizes a variable-length stack array from attacker-controlled OLE2 stream data. An attacker crafts a malicious StarOffice-format document; when any libextractor-based application extracts its metadata, the parser can be driven to allocate up to 4 MB on the stack, overflowing it and crashing the process. The CVSS 4.0 score of 8.7 reflects a network attack vector with no privileges, no user interaction, and availability-only impact (VA:H, VC:N/VI:N), so the demonstrated effect is denial of service rather than code execution. Any product or service that links libextractor before 1.15 and extracts metadata from untrusted documents — for example file-indexing, search, or upload-scanning services — is affected. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

Do: Upgrade to GNU libextractor 1.15 or later, and audit whether applications that embed the library (file managers, search indexers, upload-scanning services, GNUnet) link a version before 1.15. If patching is delayed, restrict or sandbox metadata extraction of untrusted StarOffice/legacy OLE2-based documents, for example by running extraction in a separate memory-limited worker process so a crash cannot take down the parent service. Monitor metadata-extraction pipelines for crashes on OLE2/StarOffice documents as a possible indicator of attempted exploitation.

8.7—
  • GNU libextractor before 1.15
niche≈low tens of thousands of installations at most (order of magnitude)