CVE-2026-1767: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-1767 is a heap buffer overflow (read) vulnerability in the GNOME localsearch (formerly tracker-miners) MP3 Extractor component (tracker-extract-mp3). A remote attacker can exploit this flaw by supplying a specially crafted MP3 file with malformed ID3 performer tags, triggering an incorrect length calculation that causes a read beyond the allocated heap buffer. Affected software includes GNOME localsearch (all versions listed as affected) and Red Hat Enterprise Linux 8.0, 9.0, and 10.0. The vulnerability was first reported on February 2, 2026, and published to the NVD on June 16, 2026. It carries a CVSS v3.1 base score of 5.6 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value). The flaw resides in the extract_performers_tags function within src/extractor/tracker-extract-mp3.c. When parsing ID3v2 performer tags in a loop, the code passes csize - offset as the maximum length to id3v2_text_to_utf8 (and subsequently to iconv), but text_performer actually points to data[pos + offset]. The correct remaining buffer size should be csize - pos - offset; as pos advances in subsequent loop iterations, csize - offset grows larger than the actual remaining buffer, allowing iconv to read past the end of the allocated region. Exploitation requires a local attacker with low privileges to cause a user (or automated indexing process) to process a malicious MP3 file; no network-direct code path exists, but the file can be delivered remotely (Red Hat Bugzilla, Github Advisory).

Successful exploitation can result in two primary outcomes: a Denial of Service (DoS) via a crash of the tracker-extract process when the out-of-bounds read accesses unmapped memory (segfault), or information disclosure by reading sensitive data from heap memory if the read does not immediately cause a crash. Integrity is not impacted. The affected component runs as a background indexing service, so a crash would disrupt file metadata indexing but is unlikely to enable lateral movement or privilege escalation on its own (Red Hat Bugzilla, Github Advisory).

A proof-of-concept (PoC) reproduction MP3 file and build instructions (using AddressSanitizer) are publicly documented in the Red Hat Bugzilla report, demonstrating a confirmed heap-buffer-overflow read of 582 bytes past the allocated region. The EPSS score is approximately 0.19–0.25%, indicating a low near-term exploitation probability. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" at this time (Red Hat Bugzilla, Github Advisory).

1. Craft malicious MP3: Create or use the published reproduction MP3 file containing malformed ID3v2 IPLS/performer tags with an incorrect length value that causes the extract_performers_tags loop to miscalculate the remaining buffer size.
2. Deliver the file: Place the crafted MP3 in a location accessible to the target system — e.g., a shared folder, email attachment, or downloaded file — where GNOME localsearch will automatically index it (e.g., the user's home directory or a monitored media folder).
3. Trigger indexing: Wait for the GNOME localsearch daemon (tracker-miner-fs) to automatically detect and process the new file, or manually invoke localsearch-extractor-3 --file <malicious.mp3> if local access is available.
4. Heap buffer overflow triggered: The extract_performers_tags function in tracker-extract-mp3.c calls id3v2_text_to_utf8 with csize - offset instead of csize - pos - offset, causing iconv to read 582+ bytes beyond the allocated 584-byte heap buffer.
5. Achieve DoS or information disclosure: The out-of-bounds read either causes a segfault (crashing tracker-extract, DoS) or, under favorable heap layout conditions, reads sensitive heap data that may be observable via error output or side channels (Red Hat Bugzilla).

• Process: Unexpected crash or segfault of the tracker-extract or localsearch-extractor-3 process; repeated restarts of the tracker-extract daemon.
• Logs: AddressSanitizer output (if enabled) showing heap-buffer-overflow in iconv called from extract_performers_tags in tracker-extract-mp3.c; system journal entries for tracker-extract process termination with signal 11 (SIGSEGV).
• File System: Presence of a suspicious or unexpected MP3 file in indexed directories (home folder, media directories) with malformed or oversized ID3 IPLS/performer tags.
• Network: Unusual inbound file transfers (e.g., via email, SMB, HTTP) delivering MP3 files to monitored directories on systems running GNOME localsearch (Red Hat Bugzilla).

Patches are available from Red Hat (tracked via Bugzilla bug 2435983) and through the GitHub Advisory Database (GHSA-f723-ggf4-5m9h). Users should apply available vendor updates for GNOME localsearch/tracker-miners on affected Red Hat Enterprise Linux 8, 9, and 10 systems, as well as Ubuntu, Fedora, SUSE, Amazon Linux 2023, and Debian distributions that have issued advisories. As a workaround, administrators can restrict which directories are indexed by GNOME localsearch to exclude untrusted or externally supplied MP3 files, and monitor for unexpected crashes in the tracker-extract process (Red Hat Advisory, Github Advisory, Red Hat Bugzilla).

The vulnerability has been picked up by multiple Linux security news aggregators including LinuxSecurity.com (covering Ubuntu and Fedora advisories), LinuxCompatible.org, and Pro-Linux.de (German-language coverage). Scanner vendors Tenable (Nessus) and Qualys have added detection plugins. No notable individual researcher commentary or significant social media discussion beyond automated CVE feed posts has been observed (Red Hat Bugzilla).