CVE-2026-116124: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-116124 is a heap-based buffer overflow vulnerability in GNOME libgsf's OLE2 document parser that can allow remote attackers to execute arbitrary code or crash the application. The flaw resides in the ole_info_read_metabat function within gsf/gsf-infile-msole.c and affects all libgsf versions up to and including 1.14.60. It was disclosed on October 26, 2026, with a patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is improper restriction of memory buffer operations (CWE-119, CWE-122, CWE-787) in the ole_info_read_metabat function of libgsf's OLE2 parser (gsf/gsf-infile-msole.c). When parsing a specially crafted OLE2 document, the function fails to properly validate input, leading to a heap-based out-of-bounds write. Exploitation requires user interaction — a victim must open a malicious OLE2 file (e.g., a legacy Microsoft Office document) — but no authentication or special privileges are required on the attacker's side. The fix is available as commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a in the GNOME libgsf GitLab repository (Red Hat Bugzilla, Github Advisory).

Successful exploitation can result in arbitrary code execution with the privileges of the user running the application that uses libgsf (e.g., a document viewer or office suite), or cause the application to crash, impacting availability. Confidentiality and integrity are also at risk, as code execution could allow an attacker to read sensitive files or modify data accessible to the affected process. The scope is limited to the vulnerable system; there is no direct impact on subsequent systems, though a compromised user session could serve as a foothold for further lateral movement (Red Hat Advisory, Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (opening a crafted OLE2 file), which reduces the likelihood of mass automated exploitation (Red Hat Advisory, Github Advisory).

1. Craft a malicious OLE2 document: Create a specially crafted OLE2-format file (e.g., a legacy .doc, .xls, or .ppt file) with a malformed mini-FAT (METABAT) structure that triggers an out-of-bounds write in the ole_info_read_metabat function when parsed by libgsf.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, or shared document) to convince the victim to open the crafted file with an application that uses libgsf for OLE2 parsing.
3. Trigger the vulnerability: When the victim opens the file, the application invokes libgsf's OLE2 parser, which calls ole_info_read_metabat in gsf/gsf-infile-msole.c. The malformed input causes a heap buffer overflow.
4. Achieve code execution or crash: Depending on heap layout and exploit reliability, the overflow may overwrite adjacent heap metadata or function pointers, potentially redirecting execution flow to attacker-controlled code running with the victim user's privileges, or causing an application crash (Red Hat Bugzilla, Github Advisory).

• File System: Unexpected or newly created files in user home directories or temp folders following the opening of an OLE2 document; presence of crafted .doc, .xls, or .ppt files with anomalous METABAT structures.
• Process: Unusual child processes spawned by document viewer or office suite applications (e.g., bash, sh, curl, wget, python) after opening an OLE2 file; application crashes (core dumps) associated with libgsf.
• Logs: Application crash logs or core dumps referencing gsf-infile-msole.c or ole_info_read_metabat; system logs showing segmentation faults or heap corruption errors from document-processing applications.
• Network: Unexpected outbound network connections from document viewer processes to unknown external IP addresses following file open events.

Apply the upstream patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a in the GNOME libgsf repository, or update to a patched version of libgsf once distributed by your Linux distribution. As an interim workaround, avoid opening OLE2 documents (legacy Microsoft Office formats) from untrusted or unknown sources. Consider using application sandboxing (e.g., Flatpak, AppArmor, or SELinux confinement) for document-processing applications to limit the impact of potential exploitation (Red Hat Bugzilla, Github Advisory).

The vulnerability was reported to Red Hat's Bugzilla and assigned high severity/priority, with the Red Hat Product Security team tracking it under CVE-2026-116124. The GitHub Advisory Database published it as "Moderate" severity (unreviewed). Social media activity was limited to automated CVE notification accounts on Mastodon (infosec.exchange) and Bluesky, with no notable independent researcher commentary or significant community discussion observed at the time of disclosure (Red Hat Bugzilla, Github Advisory).