| Titre | GNOME libgsf e3958edf77af1374118c278eb772e51c6fdbe235 Heap-based Buffer Overflow |
|---|
| Description | libgsf 1.14.60 (and current Git master as verified) contains a heap-based out-of-bounds write in gsf/gsf-infile-msole.c when parsing a crafted OLE2/Compound Document file. The small-block BAT size is calculated from attacker-controlled meta_sbat.num_blocks multiplied by the number of BAT entries per sector. The product is assigned to a guint32 num_blocks field, truncating values above UINT32_MAX. The truncated value is used to allocate sb.bat.block, but ole_info_read_metabat() then iterates over all entries described by the untruncated meta_sbat chain and writes BAT entries without checking the destination buffer bounds. This causes a heap buffer overflow with file-controlled 32-bit values. The flaw is reachable through the normal OLE2 parsing path and can be triggered with the stock gsf CLI. A non-sanitized build crashes deterministically with SIGSEGV. The demonstrated impact is heap corruption and denial of service. |
|---|
| La source | ⚠️ https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a |
|---|
| Utilisateur | suyuanwang (UID 101634) |
|---|
| Soumission | 29/09/2026 11:52 (il y a 1 mois) |
|---|
| Modérer | 25/10/2026 10:25 (26 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 426192 [GNOME libgsf jusqu’à 1.14.60 OLE2 Parser gsf/gsf-infile-msole.c ole_info_read_metabat buffer overflow] |
|---|
| Points | 20 |
|---|