CVE-2026-100310
GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor
CVSS
7.3HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.16libextractorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
Text from CVE List
Affected versions 1
- libextractoraffected: all versions before 1.16CVE List
References 5
- git.gnunet.org/gnunet/libextractor/commit/6edfa653c048800e24a17f7e8cc2bb42659b8d01.htmlFixvia CVE List
- vulncheck.com/advisories/gnu-libextractor-before-1.16-privilege-escalation-via-libextractor-prefixAdvisoryvia CVE List
- github.com/Haitam-lazaar/libextractor-privescExploitvia CVE List
- ftp.gnu.org/gnu/libextractor/Referencevia CVE List
- gnu.org/software/libextractor/Referencevia CVE List