Technical impact
The vulnerability exists because GNU libextractor loads plug‑in libraries from the directory defined by the LIBEXTRACTOR_PREFIX environment variable without verifying the executor’s privileges. A local attacker can set this variable to a directory containing a malicious plug‑in, and when that plug‑in is loaded by a setuid or setgid program it executes arbitrary code with the elevated privileges of the binary. The exploit therefore allows a non‑privileged user to gain the rights of a privileged account that runs a binary linked to libextractor.
Affected Systems
All installations of GNU libextractor prior to version 1.16 are affected. The vulnerability is present in the base library regardless of operating system or distribution, as long as the library is linked into a setuid or setgid binary.
Risk and Exploitability
The CVSS score of 7.3 indicates a high severity with medium to high impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited visibility among known exploits. However, the attack requires local access to a privileged executable that utilizes libextractor. If such a binary exists, an attacker who can set the environment variable for that process can elevate privileges to the level of that binary. The lack of a publicly documented exploit does not reduce the risk once the described conditions are met.
