CVE-2026-1765: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-1765 is a heap buffer overflow (out-of-bounds read) vulnerability in the tracker-extract-mp3 component of GNOME localsearch (formerly known as tracker-miners). It affects the extract_txxx_tags function in src/extractor/tracker-extract-mp3.c when processing User Defined Text Information Frames (TXXX) in specially crafted MP3 files. The vulnerability was reported on February 2, 2026, and published to NVD on June 16, 2026. It carries a CVSS v3.1 base score of 5.6 (Medium) (Red Hat CVE, Github Advisory).

The root cause is a missing bounds check in the extract_txxx_tags function (CWE-125: Out-of-bounds Read). When parsing TXXX frames, the code calculates an offset based on the description string length (text_desc_len) without verifying whether this offset exceeds the total frame size (csize). This allows an unsigned integer underflow: if offset > csize, the expression csize - offset wraps around to a very large value, which is then passed as the length argument to id3v24_text_to_utf8 / g_convert, causing an out-of-bounds read from the heap. The attack vector is local (AV:L), requires low privileges and user interaction (e.g., a user or automated indexer opening a malicious MP3), and a proof-of-concept crash file (base64-encoded) along with an ASAN crash log are publicly documented in the Red Hat Bugzilla report (Red Hat Bugzilla).

Successful exploitation causes a Denial of Service (DoS) by crashing the tracker-extract-mp3 process via a SIGSEGV when unmapped memory is read. Additionally, if a null byte is encountered far beyond the intended buffer boundary, the out-of-bounds read may expose sensitive heap memory contents, resulting in a low-severity information disclosure. Integrity is not impacted. The scope is limited to the affected extractor process and does not directly enable lateral movement or privilege escalation (Red Hat Bugzilla, Github Advisory).

No in-the-wild exploitation has been reported, and the NVD SSVC assessment confirms exploitation status as "none" and automation as "no" (requiring user interaction). The EPSS score is approximately 0.139% (4th percentile), indicating a low probability of near-term exploitation. A proof-of-concept crash file is publicly available in the Red Hat Bugzilla report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Bugzilla, Github Advisory).

1. Craft a malicious MP3 file: Create an MP3 file containing a TXXX (User Defined Text Information) ID3v2 frame where the description string length is crafted such that the computed offset (4 + text_desc_len + nul_size) exceeds the frame's declared size (csize), triggering an unsigned integer underflow when csize - offset is computed.
2. Deliver the file to the target: Place the malicious MP3 file in a location accessible to the target system — for example, a shared folder, email attachment, or downloaded file — where GNOME localsearch's file indexer (tracker-extract-mp3) will automatically process it, or trick a local user into opening it.
3. Trigger automatic indexing: On systems running GNOME localsearch (tracker-miners), the file indexer monitors directories (e.g., home folder) and automatically extracts metadata from new files. When the malicious MP3 is detected, tracker-extract-mp3 processes the TXXX frame.
4. Trigger the out-of-bounds read: The extract_txxx_tags function computes the oversized offset without bounds checking, passes a huge length to g_convert, and reads beyond the allocated heap buffer — causing a crash (DoS) or potentially leaking heap memory contents. (Red Hat Bugzilla)

• File System: Presence of unexpected or suspicious MP3 files in user home directories or shared folders, particularly files with unusual TXXX ID3v2 frames or abnormally small frame sizes relative to their declared content.
• Logs: Crash reports or core dumps from the localsearch-extractor-3 or tracker-extract-mp3 process; GNOME tracker/localsearch log entries showing SIGSEGV or heap-buffer-overflow errors when processing a specific MP3 file.
• Process: Unexpected termination of tracker-extract-mp3 or localsearch-extractor-3 processes; AddressSanitizer output referencing extract_txxx_tags in tracker-extract-mp3.c if ASAN-instrumented builds are in use. (Red Hat Bugzilla)

Patches have been issued by multiple distributions including Ubuntu, SUSE/openSUSE, Fedora, Amazon Linux 2023, and Debian (localsearch 3.11~rc-1). Users should update the tracker-miners / localsearch package to the patched version provided by their distribution. As a temporary workaround, users can exclude media directories from GNOME localsearch indexing to prevent automatic processing of untrusted MP3 files. Avoid opening MP3 files from untrusted sources until the patch is applied (Red Hat CVE, Red Hat Bugzilla).

The vulnerability received coverage from Linux security news outlets including LinuxSecurity.com and LinuxCompatible.org, as well as German-language security site Pro-Linux.de, primarily in the context of distribution-level patch advisories for Ubuntu, SUSE, Fedora, and Amazon Linux. Tenable published multiple Nessus detection plugins (IDs 297665, 303311, 306227, 318134, 318210) and Qualys also added detection. No notable individual researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and patch notification channels.