Catálogo de CVE

CVE-2026-1767

A flaw was found in the GNOME localsearch (previously…

[Catálogo de CVE]

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.

Gravedad
Medium · CVSS 5.6CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixietracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1767]
Debiantrixietracker-miners3.8.2-4Affected[CVE-2026-1767]
Debianbookwormtracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1767]
Debianbookwormtracker-miners3.4.3-1Affected[CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.3-2UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.5-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.6-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.6-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]

Showing 12 observations. All 31 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedenterprise_linuxNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedlocalsearchNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-extract3.7.1-1ubuntu0.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-miner-fs3.7.1-1ubuntu0.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-minersNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedtracker-miners3.7.1-1ubuntu0.1UnknownSource applicability is not establishedProvider not reported
Debianbookwormtracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1767]
Debianbookwormtracker-miners3.4.3-1Affected[CVE-2026-1767]
Debiantrixietracker-minersNot reportedAffectedDistribution reports no fix[CVE-2026-1767]
Debiantrixietracker-miners3.8.2-4Affected[CVE-2026-1767]
Ubuntu22.04tracker-miners3.1.3-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.1.3-4UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.0-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.0~beta-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.0~rc-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.2UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.3UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu22.04tracker-miners3.3.3-0ubuntu0.20.04.4UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.3-2UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.5-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.6-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.4.6-3UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.7.0-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.7.1-1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.7.1-1build1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu24.04tracker-miners3.7.1-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Ubuntu25.10tracker-miners3.8.2-4ubuntu2.1UnknownSource applicability is not established[UBUNTU-CVE-2026-1767]
Original provider fields
{
  "package_releases": [
    {
      "name": "tracker-miners",
      "status": "vulnerable",
      "release": "trixie",
      "version": "3.8.2-4"
    },
    {
      "name": "tracker-miners",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "3.4.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "tracker-miners",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "tracker-miners",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "tracker-miners",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "localsearch",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "enterprise_linux",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "applicability_unknown": true
    },
    {
      "name": "tracker-extract",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miner-fs",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.3-0ubuntu0.20.04.4"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.1.3-1",
        "3.1.3-4",
        "3.3.0~beta-1",
        "3.3.0~rc-1",
        "3.3.0-1",
        "3.3.3-0ubuntu0.20.04.1",
        "3.3.3-0ubuntu0.20.04.2",
        "3.3.3-0ubuntu0.20.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1767",
      "fixed_version": "3.3.3-0ubuntu0.20.04.4",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1767",
      "provider_updated_at": "2026-06-24T11:00:18.756118135Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.1-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "3.4.3-2",
        "3.4.5-3",
        "3.4.6-1",
        "3.4.6-3",
        "3.7.0-1",
        "3.7.1-1",
        "3.7.1-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1767",
      "fixed_version": "3.7.1-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1767",
      "provider_updated_at": "2026-06-24T11:00:18.756118135Z",
      "applicability_unknown": true
    },
    {
      "name": "tracker-miners",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.2-4ubuntu2.1"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "3.8.2-4",
        "3.8.2-4ubuntu1",
        "3.8.2-4ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-1767",
      "fixed_version": "3.8.2-4ubuntu2.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-1767",
      "provider_updated_at": "2026-06-24T11:00:18.756118135Z",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] tracker-miners: Minor issue [bookworm] tracker-miners: Minor issue

OpenFactory catalog packages

La asociación de paquetes está en curso.

[Debian 12 (Bookworm)]

  • [tracker-extract]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.4.3-1 · amd64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

    • 3.4.3-1 · arm64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

  • [tracker-miner-fs]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.4.3-1 · amd64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

    • 3.4.3-1 · arm64 · bookworm

      Afectada

      nvd · tracker-miners · debian · bookworm; nvd · tracker-miners · debian · 12

[Debian 13 (Trixie)]

  • [tracker-extract]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.8.2-4+b1 · amd64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

    • 3.8.2-4+b1 · arm64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

  • [tracker-miner-fs]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.8.2-4 · all · trixie

      Afectada

      nvd · tracker-miners · debian · 13

    • 3.8.2-4 · all · trixie

      Afectada

      nvd · tracker-miners · debian · 13

  • [tracker-test-utils]Desconocido

    Paquete fuente: [tracker-miners]

    Detalles (2)

    • 3.8.2-4+b1 · amd64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

    • 3.8.2-4+b1 · arm64 · trixie

      Afectada

      nvd · tracker-miners · debian · 13

Observado:

Referencias

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]