Live › vulnerability › CVE-2026-116124
Go to dashboardGNOME libgsf up to 1.14.60 has a heap-based buffer overflow in the OLE2 parser function ole_info_read_metabat, which handles crafted Office-style compound files. An attacker who can get a malicious file opened by an application using libgsf can corrupt memory, which may lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Systems that run libgsf 1.14.60 or earlier and parse untrusted OLE2 compound files, such as document converters, thumbnailers or previewers. Systems that do not use libgsf, or only handle trusted files, are less exposed. The sources do not name specific distributions or products that ship it.
No product ranges from the sources yet.
pkg-config --modversion libgsf-1 and compare it to 1.14.60.ldd on the binaries that parse OLE or Office files.1.14.60 to a release that includes upstream commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-116124")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.