CVE-2026-116124

GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.

Analysis

AI-generated

Technical impact

The vulnerability is a heap‑based buffer overflow in the function ole_info_read_metabat within the OLE2 parser component of GNOME libgsf. An attacker can supply specially crafted input to a program that consumes OLE2 files, causing a buffer overflow that may allow arbitrary code execution. The weakness corresponds to the known CWE-119, CWE-122, and CWE-787 vulnerabilities.

Affected Systems

The flaw affects versions of GNOME libgsf up to and including 1.14.60. Systems that use older or default libgsf installations are vulnerable. The vulnerability specifically targets the OLE2 parser in gsf-infile-msole.c. All systems using libgsf 1.14.60 or earlier without the patch are impacted.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. EPSS is not available, so the probability of exploitation remains uncertain. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can trigger the overflow remotely by feeding malicious OLE2 data to a vulnerable application. Because the flaw resides in heap memory manipulation, successful exploitation could lead to remote code execution if the attacker controls the input context.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch identified by the commit hash a8e25560b74f84c3f86df6ca0ac59195fa5af68a or upgrade to libgsf 1.14.61 or later
  • Restart any applications or services that load libgsf so that the patched library is used
  • Monitor logs for abnormal activity from OLE2 parsing after the update to confirm neutralization

Generated by OpenCVE AI on October 26, 2026 at 13:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.
Title GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow
First Time appeared Gnome
Gnome libgsf
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:gnome:libgsf:*:*:*:*:*:*:*:*
Vendors & Products Gnome
Gnome libgsf
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow

  • CWE-787

    Out-of-bounds Write

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 8:50 PM
Reserved
Oct 25, 2026, 9:25 AM

View source JSON

Updated
Oct 29, 2026, 8:50 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 7:17 AM
Modified
Oct 29, 2026, 9:17 PM

View source JSON

Severity
Important
Public date
Oct 26, 2026, 6:00 AM

View source Bugzilla JSON

Updated
Oct 26, 2026, 1:30 PM

JSON