CVE-2026-1764: Gnome Localsearch

Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.

Affected products

• Gnome Localsearch: affected versions not specified
• Red Hat Enterprise Linux: version 8.0 only; version 9.0 only; version 10.0 only

Published 2026-06-16. Last modified 2026-06-18.