Description
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GNU libextractor
Default version status: unaffected
0 to < 1.15affected
References
- https://github.com/Haitam-lazaar/libextractor-ole2-rce ↗
- https://git.gnunet.org/gnunet/libextractor/commit/04004eb19033e093938138b09befdf31e71e8522.html ↗
- https://git.gnunet.org/gnunet/libextractor/commit/2781c7e9095f4ddaff4f535d69342f3903b18422.html ↗
- https://www.gnu.org/software/libextractor/ ↗
- https://www.vulncheck.com/advisories/gnu-libextractor-before-1.15-stack-overflow-via-ole2 ↗
- http://www.openwall.com/lists/oss-security/2026/09/16/16 ↗