CVE-2026-91752: GNU libextractor Buffer Overflow Vulnerability

CVE-2026-91752 Overview

CVE-2026-91752 is a stack-based buffer overflow in GNU libextractor versions prior to 1.15. The flaw resides in the process_star_office function, which sizes a variable-length stack array using untrusted OLE2 stream data. A crafted StarOffice document can direct the function to allocate up to 4 MB on the stack, exhausting stack memory and crashing any application that extracts metadata from the file. The weakness is classified as [CWE-789] Memory Allocation with Excessive Size Value. Because libextractor is embedded in file managers, indexers, and desktop search tools, the attack surface extends across any host that automatically parses untrusted documents.

Critical Impact
Remote attackers can crash any process linking GNU libextractor by delivering a single malicious OLE2 document, disrupting file indexers, mail scanners, and desktop search services.

Affected Products

GNU libextractor versions prior to 1.15
Applications embedding libextractor for metadata extraction from OLE2 or StarOffice documents
Downstream distributions packaging vulnerable libextractor releases

Discovery Timeline

2026-09-15 - CVE-2026-91752 published to the National Vulnerability Database
2026-09-16 - Public discussion on the OpenWall oss-security mailing list
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91752

Vulnerability Analysis

GNU libextractor is a plugin-based library that extracts metadata from documents, media files, and archives. The process_star_office function parses StarOffice and OpenOffice OLE2 streams to recover embedded metadata. During parsing, the function reads a length value from the OLE2 stream and uses it directly to declare a variable-length array (VLA) on the stack.

Because the length field is attacker-controlled and not bounded before allocation, a crafted document can request up to 4 MB of stack space. On typical Linux processes with an 8 MB default stack, and less on threaded workers, this allocation exceeds available stack pages and triggers a segmentation fault. The library terminates the host application, converting document parsing into a reliable denial-of-service primitive.

Root Cause

The root cause is trusting an untrusted size field from the OLE2 container when sizing a stack allocation. The function omits an upper-bound sanity check before the VLA declaration, so any oversized length value directly translates into a stack allocation of that size. This maps to [CWE-789] Memory Allocation with Excessive Size Value.

Attack Vector

Exploitation requires no authentication and no user interaction beyond delivering the malicious document to a system that automatically extracts metadata. Realistic delivery paths include email attachments processed by scanners, files placed in indexed directories, uploads to web services that call libextractor, and desktop file managers that generate thumbnails or previews. The publicly available proof-of-concept in the GitHub PoC Repository demonstrates crashing a target by opening a crafted document. Detailed exploitation mechanics are documented in the VulnCheck Advisory on Libextractor.

Detection Methods for CVE-2026-91752

Indicators of Compromise

Repeated segmentation faults or SIGSEGV signals in processes linking libextractor.so when parsing OLE2 or StarOffice content
Unexpected termination of file indexers, mail gateways, or thumbnailers shortly after ingesting untrusted documents
Presence of OLE2 documents with abnormally large stream length fields sourced from external senders

Detection Strategies

Inventory hosts and containers that ship libextractor and identify installed versions below 1.15 using package manager queries such as dpkg -l libextractor* or rpm -q libextractor
Enable core dump collection on services that call libextractor and alert on crashes with stack pointers outside the mapped stack region
Inspect inbound OLE2 documents at mail and web proxies for oversized directory entries or malformed StarOffice streams

Monitoring Recommendations

Forward crash telemetry from indexing daemons, antivirus scanners, and desktop search services to a central log platform
Correlate document ingestion events with process crashes to identify targeted delivery attempts
Track upstream advisories from the GNU Libextractor Overview project for follow-on fixes

How to Mitigate CVE-2026-91752

Immediate Actions Required

Upgrade GNU libextractor to version 1.15 or later on all systems that link the library
Restart any long-running services, including file indexers and mail scanners, after upgrading to load the patched code
Block or quarantine untrusted OLE2 and StarOffice documents at network perimeter until patches are deployed

Patch Information

The maintainers addressed the flaw in two upstream commits. The remediation adds bounds checking before the stack allocation in process_star_office, rejecting oversized length values sourced from OLE2 streams. Review the fixes in the GNUnet Commit Update and the GNUnet Commit Patch. Distribution maintainers should backport both commits to any supported libextractor releases below 1.15.

Workarounds

Disable the StarOffice or OLE2 extractor plugin in libextractor configuration where feasible until the upgrade is applied
Restrict libextractor callers to run under process supervisors that auto-restart on crash and isolate them with seccomp or a dedicated user account
Filter inbound .sxw, .doc, and related OLE2-based file types at mail gateways and upload endpoints during the remediation window

bash

# Verify installed libextractor version and upgrade on Debian/Ubuntu
dpkg -l | grep libextractor
sudo apt-get update && sudo apt-get install --only-upgrade libextractor3 libextractor-plugins

# Verify on RHEL/Fedora
rpm -q libextractor
sudo dnf upgrade libextractor