CVE-2026-1764: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-1764 is a heap buffer overflow (out-of-bounds read) vulnerability in GNOME localsearch (formerly known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the extract_performers_tags function allows the loop to advance beyond the buffer boundary, leading to a Denial of Service (DoS) or potential information disclosure. Affected software includes GNOME localsearch (all versions tracked under the CPE) and Red Hat Enterprise Linux 8, 9, and 10. The vulnerability was first reported on February 2, 2026, and published to the NVD on June 16, 2026. It carries a CVSS v3.1 base score of 5.6 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). In src/extractor/tracker-extract-mp3.c, the extract_performers_tags function iterates over ID3v2.4 performer tags without verifying that pos + offset remains within the buffer size (csize). When pos + offset exceeds csize, the remaining length calculation (csize - pos - offset) underflows, wrapping to a very large unsigned value that, when cast to a signed gssize, is interpreted as -1. This causes g_convert to invoke strlen on the buffer, which reads heap memory until it finds a null byte or crashes. Exploitation requires a local attacker with low privileges to induce a user (or automated indexing service) to process a malicious MP3 file. A proof-of-concept base64-encoded MP3 file with MD5 checksum 22ff0943d674fd14f72b34a9b32191b5 that triggers an AddressSanitizer SIGSEGV crash has been publicly disclosed (Red Hat Bugzilla).

Successful exploitation causes the GNOME localsearch/tracker-miners extractor process to crash (SIGSEGV) due to a read of unmapped memory, resulting in a Denial of Service for the file indexing service. In cases where a null byte is found at a distance in heap memory, the vulnerability may also lead to information disclosure by exposing visible heap data to the attacker. Integrity is not affected, and the scope is limited to the vulnerable component without privilege escalation or lateral movement potential (Red Hat Bugzilla, Github Advisory).

A proof-of-concept exploit (a crafted MP3 file with decoding instructions and ASAN crash logs) is publicly available in the Red Hat Bugzilla report. There is no evidence of in-the-wild exploitation at this time, and the NVD SSVC assessment classifies exploitation as "none" and automation as "no." The EPSS score is approximately 0.19–0.21%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Bugzilla, Github Advisory).

1. Craft a malicious MP3 file: Create or obtain a specially crafted MP3 file containing malformed ID3v2.4 tags where the performer tag data is structured so that pos + offset exceeds the buffer size (csize). The publicly disclosed PoC file (MD5: 22ff0943d674fd14f72b34a9b32191b5) can be decoded from the base64 string in the Bugzilla report.
2. Deliver the file to the target system: Place the malicious MP3 file in a directory monitored by the GNOME localsearch/tracker-miners indexing service (e.g., the user's home directory or a mounted media path), or socially engineer a user to open or copy the file.
3. Trigger automatic indexing: The localsearch/tracker-miners service automatically indexes new files in monitored directories. When it processes the malicious MP3, the extract_performers_tags function is invoked.
4. Trigger the out-of-bounds read: The missing bounds check causes pos + offset to exceed csize, leading to an integer underflow in the remaining length calculation. g_convert is called with a length of -1, causing strlen to read beyond the buffer.
5. Achieve DoS or information disclosure: The extractor process crashes with a SIGSEGV (DoS), or in favorable heap layouts, reads and potentially exposes heap data before encountering a null byte (Red Hat Bugzilla).

• File System: Presence of unexpected or suspicious MP3 files in user home directories or indexed media folders, particularly files with unusual ID3v2.4 tag structures or very small/malformed sizes.
• Process: Unexpected crashes or restarts of the localsearch-extractor-3 or tracker-extract process; core dump files generated by these processes in /var/crash/ or the user's home directory.
• Logs: System journal entries (via journalctl) showing SIGSEGV or segmentation fault signals from localsearch-extractor-3 or tracker-extract; AddressSanitizer output referencing tracker-extract-mp3.c or extract_performers_tags.
• Network: No network-based IOCs are expected given the local attack vector (Red Hat Bugzilla).

Apply security updates from your Linux distribution vendor that include a patched version of GNOME localsearch/tracker-miners. Red Hat has tracked the fix in Bugzilla Bug 2435980, and patches are available for Red Hat Enterprise Linux 8, 9, and 10. Oracle Solaris 11.4 users should apply the patch released in the April 2026 Third Party Bulletin (SRU 93 or later). As a workaround, restrict access to untrusted MP3 files, disable MP3 extraction functionality in tracker-miners if not required, or configure localsearch to exclude directories containing untrusted media files (Red Hat Advisory, Oracle Bulletin, Red Hat Bugzilla).

The vulnerability received routine coverage from Linux security news aggregators, including LinuxSecurity.com (Ubuntu and SUSE advisories), LinuxCompatible.org (Ubuntu, Fedora, and SUSE update notices), and Pro-Linux.de (German-language security summaries). No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation. The moderate CVSS score and local-only attack vector have limited broader industry attention.