CVE-2026-1765

Name	CVE-2026-1765
Description	A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1126910

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
localsearch (PTS)	forky, sid	3.11.1-3	fixed
tracker-miners (PTS)	bullseye	2.3.5-2.1	vulnerable
	bookworm	3.4.3-1	vulnerable
	trixie	3.8.2-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
localsearch	source	(unstable)	3.8.2-12			1126910
tracker-miners	source	(unstable)	(unfixed)

Notes

[trixie] - tracker-miners <no-dsa> (Minor issue)
[bookworm] - tracker-miners <no-dsa> (Minor issue)
[bullseye] - tracker-miners <postponed> (Minor issue)
https://gitlab.gnome.org/GNOME/localsearch/-/issues/427
Fixed by: https://gitlab.gnome.org/GNOME/localsearch/-/commit/79f47309bad068ff0c19c1431abab6766edc687f