GNU libextractor and Inetutils flaws; escalation impact disputed

oss-security covers libextractor CVE-2026-100310 and Inetutils CVE-2026-95510; a reply questions whether the escalation is realistic.

Two distinct GNU issues were discussed on oss-security on 2026-09-25 and 2026-09-26. CVE-2026-100310 affects GNU libextractor before 1.16: get_installation_paths() in extractor_plugpath.c takes plugin paths from LIBEXTRACTOR_PREFIX without verifying the calling process, which can redirect plugin loading and enable local privilege escalation. Simon McVittie disputes the practical severity, asking whether the library was ever advertised as safe for setuid, setgid, or other privileged processes and noting that package descriptions present it as a metadata library for file-sharing networks, file managers, and web-indexing bots rather than a typical setuid use case. Separately, CVE-2026-95510, disclosed by Collin Funk after Brian Mak privately reported a libinetutils bug on 2026-09-14, uses an uninitialized struct sigaction in a function used by rlogin, rlogind, and telnetd. Mak saw telnetd crash, which can cause denial of service, and maintainers discussed possible code execution on some platforms, though possible exploits are not fully clear. No in-the-wild exploitation is reported for either flaw.

• CVE-2026-100310 affects GNU libextractor before 1.16.
• get_installation_paths() in extractor_plugpath.c uses getenv("LIBEXTRACTOR_PREFIX") for plugin paths without verifying the calling process, which can redirect plugin loading and enable local privilege escalation.
• Simon McVittie questions whether the library was ever advertised as safe for setuid, setgid, or other privileged processes; package descriptions present it as a metadata library for file-sharing networks, file managers, and web-indexing…
• CVE-2026-95510, disclosed by Collin Funk after Brian Mak privately reported a libinetutils bug on 2026-09-14, uses an uninitialized struct sigaction in a function used by rlogin, rlogind, and telnetd.
• Mak observed telnetd crashing, which can cause denial of service; maintainers also discussed possible code execution on some platforms, though exploitability is not fully clear.
• No in-the-wild exploitation is reported for either flaw.