CVE-2026-1767: gnome localsearch
Vulnerability summary
CVE-2026-1767 is a high (CVSS 8.1) vulnerability in gnome localsearch. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 16-06-2026PublishedVulnerability first disclosed.
- 16-06-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
0.00 pp
From 0.25% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- localsearch< 3.8.2-12
- tracker-minersAll versions (No fix recorded)
Gnome1 product
Redhat1 product
- enterprise_linux8.0 | 9.0 | 10.0
Ubuntu1 product
- tracker-miners< 3.3.3-0ubuntu0.20.04.4 | < 3.7.1-1ubuntu0.1 | < 3.8.2-4ubuntu2.1
4 vendors · 5 products
References
6 links- bugzilla.redhat.com/show_bug.cgi?id=2435983Issue TrackingX Refsource REDHATExploitThird Party Advisory
