As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2
GNU libextractor before version 1.15 contains a stack-based buffer overflow in the OLE2 plugin, specifically in the process_star_office function that allocates stack memory based on attacker-controlled data. CVE-2026-91752 affects the library's handling of malicious OLE2 stream input.
Why it matters: Organizations and developers using GNU libextractor versions prior to 1.15 to process potentially untrusted OLE2 files face remote code execution risk and should upgrade immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2
GNU libextractor before version 1.15 contains a stack-based buffer overflow in the OLE2 plugin's process_star_office function, where an attacker-controlled stream parameter sizes a variable-length stack array. The vulnerability, tracked as CVE-2026-91752 with a CVSS score of 8.7, can be triggered through a crafted malicious OLE2 file.
Why it matters: Organizations and developers using GNU libextractor to parse documents are exposed to potential code execution; upgrade to version 1.15 or later to patch the stack overflow.
- Source published
- First seen by Cybersecurity Tracker