CVE-2026-91752 GNU libextractor before 1.15 Stack Overflow via OLE2
Attackers can crash applications using GNU libextractor by sending malicious StarOffice documents that trigger a stack overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91752?
CVE-2026-91752 is a high-severity memory corruption vulnerability in GNU libextractor, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.
Weakness: CWE-789
Which versions are affected by CVE-2026-91752?
How do I fix CVE-2026-91752?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-91752 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91752 exists.
Sources
Also known as DEBIAN-CVE-2026-91752, GHSA-vrwm-2jf2-f6fv, UBUNTU-CVE-2026-91752.