Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116124GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow

Medium 6.3

In plain English

A medium-severity heap buffer overflow in libgsf from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libgsfno fix listedDEBIAN-CVE-2026-116124
Debian:13libgsfno fix listedDEBIAN-CVE-2026-116124
Debian:14libgsfno fix listedDEBIAN-CVE-2026-116124
Ubuntu:22.04:LTSlibgsfno fix listedUBUNTU-CVE-2026-116124
Ubuntu:24.04:LTSlibgsfno fix listedUBUNTU-CVE-2026-116124
Ubuntu:26.04:LTSlibgsfno fix listedUBUNTU-CVE-2026-116124
Ubuntu:26.10libgsfno fix listedUBUNTU-CVE-2026-116124

Affected products (as reported)

VendorProductVersions
GNOME libgsf 1.14.01.14.11.14.21.14.31.14.41.14.51.14.61.14.7

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References