CVE-2026-1764EPSS p11.2%

CVE-2026-1764CVE-2026-1764

gnome / localsearch

Description

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.

Scoring

CVSS 5.6 ()
VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
EPSS0.21% probability of exploitation · percentile 11.2% · 2026-08-03T12:00:16Z
Last modified2026-06-18
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.