| शीर्षक | GNOME libgsf e3958edf77af1374118c278eb772e51c6fdbe235 Heap-based Buffer Overflow |
|---|
| विवरण | libgsf 1.14.60 (and current Git master as verified) contains a heap-based out-of-bounds write in gsf/gsf-infile-msole.c when parsing a crafted OLE2/Compound Document file. The small-block BAT size is calculated from attacker-controlled meta_sbat.num_blocks multiplied by the number of BAT entries per sector. The product is assigned to a guint32 num_blocks field, truncating values above UINT32_MAX. The truncated value is used to allocate sb.bat.block, but ole_info_read_metabat() then iterates over all entries described by the untruncated meta_sbat chain and writes BAT entries without checking the destination buffer bounds. This causes a heap buffer overflow with file-controlled 32-bit values. The flaw is reachable through the normal OLE2 parsing path and can be triggered with the stock gsf CLI. A non-sanitized build crashes deterministically with SIGSEGV. The demonstrated impact is heap corruption and denial of service. |
|---|
| स्रोत | ⚠️ https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a |
|---|
| उपयोगकर्ता | suyuanwang (UID 101634) |
|---|
| सबमिशन | 29/09/2026 11:52 AM (1 महीना पहले) |
|---|
| संयम | 25/10/2026 10:25 AM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426192 [GNOME libgsf तक 1.14.60 OLE2 Parser gsf/gsf-infile-msole.c ole_info_read_metabat बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|