CVE-2026-100310

Name	CVE-2026-100310
Description	GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libextractor (PTS)	bookworm	1:1.11-7	vulnerable
	trixie	1:1.13-8	vulnerable
	forky, sid	1:1.19-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libextractor	source	(unstable)	1:1.17-1

Notes

https://www.openwall.com/lists/oss-security/2026/09/25/25
https://github.com/Haitam-lazaar/libextractor-privesc
Fixed by: https://git.gnunet.org/gnunet/libextractor/commit/6edfa653c048800e24a17f7e8cc2bb42659b8d01.html