CVE-2026-1767

Name	CVE-2026-1767
Description	A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1126910

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
localsearch (PTS)	forky, sid	3.11.1-3	fixed
tracker-miners (PTS)	bullseye	2.3.5-2.1	fixed
	bookworm	3.4.3-1	vulnerable
	trixie	3.8.2-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
localsearch	source	(unstable)	3.8.2-12	1126910
tracker-miners	source	bullseye	(not affected)
tracker-miners	source	(unstable)	(unfixed)

Notes

[trixie] - tracker-miners <no-dsa> (Minor issue)
[bookworm] - tracker-miners <no-dsa> (Minor issue)
[bullseye] - tracker-miners <not-affected> (support for performer tags was added in v2.99.4)
https://gitlab.gnome.org/GNOME/localsearch/-/issues/429
Fixed by: https://gitlab.gnome.org/GNOME/localsearch/-/commit/2897ca48b7ae79db7dcfe7e66cdd5d75cb641466