CVE-2026-100310 GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Local attackers can escalate privileges by setting LIBEXTRACTOR_PREFIX to load malicious plugins in setuid programs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100310?
CVE-2026-100310 is a high-severity vulnerability in GNU libextractor, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
Weakness: CWE-426
Which versions are affected by CVE-2026-100310?
How do I fix CVE-2026-100310?
Upgrade to a fixed version.
Is CVE-2026-100310 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100310 exists.
Sources
Also known as DEBIAN-CVE-2026-100310, GHSA-rxpm-xfjv-mq65, UBUNTU-CVE-2026-100310.