The vulnerability is a heap‑based buffer overflow in the function ole_info_read_metabat within the OLE2 parser component of GNOME libgsf. An attacker can supply specially crafted input to a program that consumes OLE2 files, causing a buffer overflow that may allow arbitrary code execution. The weakness corresponds to the known CWE-119 and CWE-122 vulnerabilities.

The flaw affects versions of GNOME libgsf up to and including 1.14.60. Systems that use older or default libgsf installations are vulnerable. The vulnerability specifically targets the OLE2 parser in gsf-infile-msole.c. All systems using libgsf 1.14.60 or earlier without the patch are impacted.

The CVSS score is 5.3, indicating moderate severity. EPSS is not available, so the probability of exploitation remains uncertain. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can trigger the overflow remotely by feeding malicious OLE2 data to a vulnerable application. Because the flaw resides in heap memory manipulation, successful exploitation could lead to remote code execution if the attacker controls the input context.