{"id":"CVE-2026-116124","kind":"vulnerability","aliases":["CVE-2026-116124"],"related":[],"title":"GNOME libgsf: heap overflow in OLE2 parser lets remote files corrupt memory","description":"A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.","summary":"GNOME libgsf up to 1.14.60 has a heap-based buffer overflow in the OLE2 parser function ole_info_read_metabat, which handles crafted Office-style compound files. An attacker who can get a malicious file opened by an application using libgsf can corrupt memory, which may lead to code execution.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","gnome","libgsf","package","self-hosted"],"not_affected_if":["no-libgsf-installed","trusted-files-only"],"how_to_check":"- Check the installed libgsf version with `pkg-config --modversion libgsf-1` and compare it to `1.14.60`.\n- Find applications that link libgsf, for example with `ldd` on the binaries that parse OLE or Office files.","fix":"- Move libgsf past `1.14.60` to a release that includes upstream commit `a8e25560b74f84c3f86df6ca0ac59195fa5af68a`.\n- Until patched, avoid opening untrusted OLE2 or Office files with applications that use libgsf.","status":"open","published_at":"2026-10-26T07:17:09+00:00","first_seen_at":"2026-10-26T07:28:50+00:00","triaged_at":"2026-10-26T07:29:54+00:00","updated_at":"2026-10-26T07:29:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T07:29:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move libgsf past `1.14.60` to a release that includes upstream commit `a8e25560b74f84c3f86df6ca0ac59195fa5af68a`.\n- Until patched, avoid opening untrusted OLE2 or Office files with applications that use libgsf.","reach":"internet","title":"GNOME libgsf: heap overflow in OLE2 parser lets remote files corrupt memory","impact":"high","summary":"GNOME libgsf up to 1.14.60 has a heap-based buffer overflow in the OLE2 parser function ole_info_read_metabat, which handles crafted Office-style compound files. An attacker who can get a malicious file opened by an application using libgsf can corrupt memory, which may lead to code execution.","category":"package","nicknames":[],"who_cares":["libgsf","gnome","self-hosted","document-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Heap overflow may let crafted files run code in the parsing process.","analyst_note":"Find the fixed release number and which distributions ship libgsf; check NVD and the upstream GNOME commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a for the exact affected range.","how_to_check":"- Check the installed libgsf version with `pkg-config --modversion libgsf-1` and compare it to `1.14.60`.\n- Find applications that link libgsf, for example with `ldd` on the binaries that parse OLE or Office files.","needs_analyst":true,"not_affected_if":["no-libgsf-installed","trusted-files-only"],"who_is_affected":"Systems that run libgsf 1.14.60 or earlier and parse untrusted OLE2 compound files, such as document converters, thumbnailers or previewers. Systems that do not use libgsf, or only handle trusted files, are less exposed. The sources do not name specific distributions or products that ship it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3371,"output_tokens":692,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116124':15A,18A '-2026':14A,17A '1.14.60':32B,91C 'a8e25560b74f84c3f86df6ca0ac59195fa5af68a':132C 'appli':137C 'applic':68B 'attack':58B,121C 'base':37B,117C 'buffer':38B,118C 'code':78B 'compon':108C 'compound':55B 'corrupt':11A,72B 'craft':51B 'cve':13A,16A 'detect':85C 'document':20B 'document-process':19B 'element':94C 'execut':79B 'file':10A,56B,64B,104C 'fix':141C 'function':44B,97C 'get':61B 'gnome':1A,22B,28B,87C 'gsf/gsf-infile-msole.c':105C 'handl':50B 'heap':3A,36B,116C 'heap-bas':35B,115C 'host':27B 'identifi':127C 'impact':93C 'info':46B,99C 'initi':124C 'issu':143C 'lead':76B,113C 'let':8A 'libgsf':2A,23B,29B,70B,88C 'malici':63B 'manipul':112C 'may':75B 'memori':12A,73B 'metabat':48B,101C 'offic':53B 'office-styl':52B 'ole':45B,98C 'ole2':6A,42B,109C 'open':65B 'overflow':4A,39B,119C 'packag':24B 'parser':7A,43B,110C 'patch':130C,139C 'process':21B 'read':47B,100C 'recommend':135C 'remot':9A,125C 'secur':81C 'self':26B 'self-host':25B 'style':54B 'use':69B 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Systems that run libgsf 1.14.60 or earlier and parse untrusted OLE2 compound files, such as document converters, thumbnailers or previewers. Systems that do not use libgsf, or only handle trusted files, are less exposed. The sources do not name specific distributions or products that ship it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116124","severity":null,"published_at":"2026-10-26T07:17:09+00:00","modified_at":"2026-10-26T07:17:09+00:00","first_seen_at":"2026-10-26T07:28:50+00:00","fetched_at":"2026-10-26T07:28:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}