By vendor

Gnome vulnerabilities

Known CVEs affecting Gnome products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-1764MEDIUM 5.6

  GNOME localsearch, a desktop search indexing tool, contains a memory safety flaw in its MP3 metadata parser. When a specially crafted MP3 file with ID3v2.4 tags is processed, the software fails to properly validate tag boundaries before reading heap memory. This can crash the indexing process or leak sensitive data from the application's memory space. The vulnerability requires local access and user interaction—a user must open or index a malicious MP3 file—but the consequences can include service disruption and unintended data exposure.

• CVE-2026-1766MEDIUM 5.6

  A heap buffer overflow vulnerability exists in GNOME localsearch's MP3 file parser. When processing maliciously crafted MP3 files with corrupted ID3v2.3 comment tags, the tracker-extract-mp3 component can crash or leak sensitive data from system memory. An attacker needs local access and user interaction (opening or processing the file) to trigger the flaw. This is a moderate-risk issue affecting Linux systems running affected GNOME versions.

• CVE-2026-1767MEDIUM 5.6

  GNOME's localsearch application contains a heap buffer overflow flaw in its MP3 file processor that can be triggered when a specially crafted MP3 file with malformed ID3 tags is scanned or indexed. An attacker who can place a malicious MP3 on a system would cause the application to crash (denial of service) or potentially leak sensitive information from memory. This is not a remote code execution vulnerability and requires local access and user interaction to exploit.