Medium severity · published Oct 26, 2026
CVE-2026-116124
GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow
New
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libgsf · GNOME
1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116124
gitlab.gnome.org
https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a
vuldb.com
https://vuldb.com/cve/CVE-2026-116124
vuldb.com
https://vuldb.com/submit/1004965
vuldb.com
https://vuldb.com/vuln/426192
vuldb.com
https://vuldb.com/vuln/426192/cti
www.gnome.org
https://www.gnome.org/
More from libgsf
7.8
CVE-2024-42415
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf)
7.8
CVE-2024-36474
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52
5.5
CVE-2016-9888
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference…