Catálogo de CVE

CVE-2026-1765

A flaw was found in the `tracker-extract-mp3` component…

[Catálogo de CVE]

A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.

Gravedad
Medium · CVSS 5.6CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixietracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1765]
Debiantrixietracker-miners3.8.2-4Affected[CVE-2026-1765]
Suselinux enterprise server ltss extended security 12 sp5tracker1.8.3-4.15.1UnknownSource applicability is not established[SUSE-SU-2026:2713-1]
Debianbookwormtracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1765]
Debianbookwormtracker-miners3.4.3-1Affected[CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.3-2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.5-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.6-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]

Showing 12 observations. All 44 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedtracker-extract3.7.1-1ubuntu0.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-miner-fs3.7.1-1ubuntu0.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-minersNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-miners3.7.1-1ubuntu0.1UnknownSource applicability is not establishedProvider not reported
Debianbookwormtracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1765]
Debianbookwormtracker-miners3.4.3-1Affected[CVE-2026-1765]
Debiantrixietracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1765]
Debiantrixietracker-miners3.8.2-4Affected[CVE-2026-1765]
Suselinux enterprise server ltss extended security 12 sp5tracker1.8.3-4.15.1UnknownSource applicability is not established[SUSE-SU-2026:2713-1]
Ubuntu18.04tracker-miners2.0.2-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu18.04tracker-miners2.0.2-1build1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu18.04tracker-miners2.0.3-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu18.04tracker-miners2.0.4-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.0-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.1-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.1-2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.1-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.1-3build1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.1-3ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.3-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.3-2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.3-2ubuntu0.20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu20.04tracker-miners2.3.3-2ubuntu0.20.04.2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.1.3-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.1.3-4UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.0-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.0~beta-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.0~rc-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.3UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.4UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.3-2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.5-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.6-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.4.6-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.7.0-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.7.1-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.7.1-1build1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu24.04tracker-miners3.7.1-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1765]
Original provider fields
{
  "package_releases": [
    {
      "name": "tracker-miners",
      "status": "vulnerable",
      "release": "trixie",
      "version": "3.8.2-4"
    },
    {
      "name": "tracker-miners",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "3.4.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "tracker-miners",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "tracker-miners",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "tracker-miners",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "applicability_unknown": true
    },
    {
      "name": "tracker-extract",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miner-fs",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "applicability_unknown": true
    },
    {
      "name": "tracker",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.3-4.15.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server ltss extended security 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:2713-1",
      "fixed_version": "1.8.3-4.15.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:2713-1",
      "provider_updated_at": "2026-07-01T09:45:07.408702452Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.0.2-1",
        "2.0.2-1build1",
        "2.0.3-1",
        "2.0.4-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1765",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1765",
      "provider_updated_at": "2026-06-24T11:01:28.823462002Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.3.0-1",
        "2.3.1-1",
        "2.3.1-2",
        "2.3.1-3",
        "2.3.1-3build1",
        "2.3.1-3ubuntu1",
        "2.3.3-1",
        "2.3.3-2",
        "2.3.3-2ubuntu0.20.04.1",
        "2.3.3-2ubuntu0.20.04.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1765",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1765",
      "provider_updated_at": "2026-06-24T11:01:28.823462002Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.3-0ubuntu0.20.04.4"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.1.3-1",
        "3.1.3-4",
        "3.3.0~beta-1",
        "3.3.0~rc-1",
        "3.3.0-1",
        "3.3.3-0ubuntu0.20.04.1",
        "3.3.3-0ubuntu0.20.04.2",
        "3.3.3-0ubuntu0.20.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1765",
      "fixed_version": "3.3.3-0ubuntu0.20.04.4",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1765",
      "provider_updated_at": "2026-06-24T11:01:28.823462002Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.1-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "3.4.3-2",
        "3.4.5-3",
        "3.4.6-1",
        "3.4.6-3",
        "3.7.0-1",
        "3.7.1-1",
        "3.7.1-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1765",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1765",
      "provider_updated_at": "2026-06-24T11:01:28.823462002Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.2-4ubuntu2.1"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "3.8.2-4",
        "3.8.2-4ubuntu1",
        "3.8.2-4ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1765",
      "fixed_version": "3.8.2-4ubuntu2.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1765",
      "provider_updated_at": "2026-06-24T11:01:28.823462002Z",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] tracker-miners: Minor issue [bookworm] tracker-miners: Minor issue

OpenFactory catalog packages

La asociación de paquetes está en curso.

[Debian 12 (Bookworm)]

  • [tracker-extract]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.4.3-1 · amd64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

    • 3.4.3-1 · arm64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

  • [tracker-miner-fs]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.4.3-1 · amd64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

    • 3.4.3-1 · arm64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

[Debian 13 (Trixie)]

  • [tracker-extract]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.8.2-4+b1 · amd64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

    • 3.8.2-4+b1 · arm64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

  • [tracker-miner-fs]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.8.2-4 · all · trixie

      Afectada

      nvd · tracker-miners · debian · 13

    • 3.8.2-4 · all · trixie

      Afectada

      nvd · tracker-miners · debian · 13

  • [tracker-test-utils]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.8.2-4+b1 · amd64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

    • 3.8.2-4+b1 · arm64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

Observado:

Referencias

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]