CVE-2026-1767: Gnome Localsearch

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.

Affected products

• Gnome Localsearch: affected versions not specified
• Red Hat Enterprise Linux: version 8.0 only; version 9.0 only; version 10.0 only

Published 2026-06-16. Last modified 2026-06-17.