CVE-2026-1766

Name	CVE-2026-1766
Description	A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1126910

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
localsearch (PTS)	forky, sid	3.11.1-3	fixed
tracker-miners (PTS)	bullseye	2.3.5-2.1	vulnerable
	bookworm	3.4.3-1	vulnerable
	trixie	3.8.2-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
localsearch	source	(unstable)	3.8.2-12			1126910
tracker-miners	source	(unstable)	(unfixed)

Notes

[trixie] - tracker-miners <no-dsa> (Minor issue)
[bookworm] - tracker-miners <no-dsa> (Minor issue)
[bullseye] - tracker-miners <postponed> (Minor issue)
https://gitlab.gnome.org/GNOME/localsearch/-/issues/428
Fixed by: https://gitlab.gnome.org/GNOME/localsearch/-/commit/9cc562cc126c408efb2a8220fcd67f006902412c