CVE-2026-1764

Name	CVE-2026-1764
Description	A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1126910

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
localsearch (PTS)	forky, sid	3.11.1-3	fixed
tracker-miners (PTS)	bullseye	2.3.5-2.1	fixed
	bookworm	3.4.3-1	vulnerable
	trixie	3.8.2-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
localsearch	source	(unstable)	3.8.2-12	1126910
tracker-miners	source	bullseye	(not affected)
tracker-miners	source	(unstable)	(unfixed)

Notes

[trixie] - tracker-miners <no-dsa> (Minor issue)
[bookworm] - tracker-miners <no-dsa> (Minor issue)
[bullseye] - tracker-miners <not-affected> (support for performer tags was added in v2.99.4)
https://gitlab.gnome.org/GNOME/localsearch/-/issues/425
Fixed by: https://gitlab.gnome.org/GNOME/localsearch/-/commit/5337e2977f159c29e2b8af575e56866862af241b