Vulnerability · Published Jun 16, 2026 · Assigned by fedora
CVE-2026-1765Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files
Medium 5.6
In plain English
A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | localsearch | 3.8.2-12 | DEBIAN-CVE-2026-1765 |
| Debian:12 | tracker-miners | no fix listed | DEBIAN-CVE-2026-1765 |
| Debian:13 | tracker-miners | no fix listed | DEBIAN-CVE-2026-1765 |
| Ubuntu:22.04:LTS | tracker-miners | 3.3.3-0ubuntu0.20.04.4 | UBUNTU-CVE-2026-1765 |
| Ubuntu:24.04:LTS | tracker-miners | 3.7.1-1ubuntu0.1 | UBUNTU-CVE-2026-1765 |
| Ubuntu:25.10 | tracker-miners | 3.8.2-4ubuntu2.1 | UBUNTU-CVE-2026-1765 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-1765 vdb-entry, x_refsource_REDHAT
- RHBZ#2435981 issue-tracking, x_refsource_REDHAT