{"id":"CVE-2026-116124","title":"GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow","summary":"A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based bu…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-122","CWE-119"],"vendor":"GNOME","product":"libgsf","affected":["libgsf 1.14.0","libgsf 1.14.1","libgsf 1.14.2","libgsf 1.14.3","libgsf 1.14.4","libgsf 1.14.5","libgsf 1.14.6","libgsf 1.14.7","libgsf 1.14.8","libgsf 1.14.9","libgsf 1.14.10","libgsf 1.14.11","libgsf 1.14.12","libgsf 1.14.13","libgsf 1.14.14","libgsf 1.14.15","libgsf 1.14.16","libgsf 1.14.17","libgsf 1.14.18","libgsf 1.14.19","libgsf 1.14.20","libgsf 1.14.21","libgsf 1.14.22","libgsf 1.14.23","libgsf 1.14.24","libgsf 1.14.25","libgsf 1.14.26","libgsf 1.14.27","libgsf 1.14.28","libgsf 1.14.29","libgsf 1.14.30","libgsf 1.14.31","libgsf 1.14.32","libgsf 1.14.33","libgsf 1.14.34","libgsf 1.14.35","libgsf 1.14.36","libgsf 1.14.37","libgsf 1.14.38","libgsf 1.14.39","libgsf 1.14.40","libgsf 1.14.41","libgsf 1.14.42","libgsf 1.14.43","libgsf 1.14.44","libgsf 1.14.45","libgsf 1.14.46","libgsf 1.14.47","libgsf 1.14.48","libgsf 1.14.49"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T06:00:16.242Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116124","references":[{"url":"https://vuldb.com/vuln/426192","label":"VDB-426192 | GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow"},{"url":"https://vuldb.com/vuln/426192/cti","label":"VDB-426192 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116124","label":"CVE-2026-116124 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1004965","label":"Submit #1004965 | GNOME libgsf e3958edf77af1374118c278eb772e51c6fdbe235 Heap-based Buffer Overflow"},{"url":"https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a"},{"url":"https://www.gnome.org/"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T07:20:03.485Z","slug":"CVE-2026-116124","body":"## Overview\n\nA security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.\n\n## Affected\n\n- `libgsf 1.14.0`\n- `libgsf 1.14.1`\n- `libgsf 1.14.2`\n- `libgsf 1.14.3`\n- `libgsf 1.14.4`\n- `libgsf 1.14.5`\n- `libgsf 1.14.6`\n- `libgsf 1.14.7`\n- `libgsf 1.14.8`\n- `libgsf 1.14.9`\n- `libgsf 1.14.10`\n- `libgsf 1.14.11`\n- `libgsf 1.14.12`\n- `libgsf 1.14.13`\n- `libgsf 1.14.14`\n- `libgsf 1.14.15`\n- `libgsf 1.14.16`\n- `libgsf 1.14.17`\n- `libgsf 1.14.18`\n- `libgsf 1.14.19`\n- `libgsf 1.14.20`\n- `libgsf 1.14.21`\n- `libgsf 1.14.22`\n- `libgsf 1.14.23`\n- `libgsf 1.14.24`\n- `libgsf 1.14.25`\n- `libgsf 1.14.26`\n- `libgsf 1.14.27`\n- `libgsf 1.14.28`\n- `libgsf 1.14.29`\n- `libgsf 1.14.30`\n- `libgsf 1.14.31`\n- `libgsf 1.14.32`\n- `libgsf 1.14.33`\n- `libgsf 1.14.34`\n- `libgsf 1.14.35`\n- `libgsf 1.14.36`\n- `libgsf 1.14.37`\n- `libgsf 1.14.38`\n- `libgsf 1.14.39`\n- `libgsf 1.14.40`\n- `libgsf 1.14.41`\n- `libgsf 1.14.42`\n- `libgsf 1.14.43`\n- `libgsf 1.14.44`\n- `libgsf 1.14.45`\n- `libgsf 1.14.46`\n- `libgsf 1.14.47`\n- `libgsf 1.14.48`\n- `libgsf 1.14.49`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}