| Titel | GNOME libgsf e3958edf77af1374118c278eb772e51c6fdbe235 Heap-based Buffer Overflow |
|---|
| Beschreibung | libgsf 1.14.60 (and current Git master as verified) contains a heap-based out-of-bounds write in gsf/gsf-infile-msole.c when parsing a crafted OLE2/Compound Document file. The small-block BAT size is calculated from attacker-controlled meta_sbat.num_blocks multiplied by the number of BAT entries per sector. The product is assigned to a guint32 num_blocks field, truncating values above UINT32_MAX. The truncated value is used to allocate sb.bat.block, but ole_info_read_metabat() then iterates over all entries described by the untruncated meta_sbat chain and writes BAT entries without checking the destination buffer bounds. This causes a heap buffer overflow with file-controlled 32-bit values. The flaw is reachable through the normal OLE2 parsing path and can be triggered with the stock gsf CLI. A non-sanitized build crashes deterministically with SIGSEGV. The demonstrated impact is heap corruption and denial of service. |
|---|
| Quelle | ⚠️ https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a |
|---|
| Benutzer | suyuanwang (UID 101634) |
|---|
| Einreichung | 29.09.2026 11:52 (vor 1 Monat) |
|---|
| Moderieren | 25.10.2026 10:25 (26 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 426192 [GNOME libgsf bis 1.14.60 OLE2 Parser gsf/gsf-infile-msole.c ole_info_read_metabat Pufferüberlauf] |
|---|
| Punkte | 20 |
|---|