| Título | GNOME libgsf e3958edf77af1374118c278eb772e51c6fdbe235 Heap-based Buffer Overflow |
|---|
| Descrição | libgsf 1.14.60 (and current Git master as verified) contains a heap-based out-of-bounds write in gsf/gsf-infile-msole.c when parsing a crafted OLE2/Compound Document file. The small-block BAT size is calculated from attacker-controlled meta_sbat.num_blocks multiplied by the number of BAT entries per sector. The product is assigned to a guint32 num_blocks field, truncating values above UINT32_MAX. The truncated value is used to allocate sb.bat.block, but ole_info_read_metabat() then iterates over all entries described by the untruncated meta_sbat chain and writes BAT entries without checking the destination buffer bounds. This causes a heap buffer overflow with file-controlled 32-bit values. The flaw is reachable through the normal OLE2 parsing path and can be triggered with the stock gsf CLI. A non-sanitized build crashes deterministically with SIGSEGV. The demonstrated impact is heap corruption and denial of service. |
|---|
| Fonte | ⚠️ https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a |
|---|
| Utilizador | suyuanwang (UID 101634) |
|---|
| Submissão | 29/09/2026 11h52 (há 28 dias) |
|---|
| Moderação | 25/10/2026 10h25 (26 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 426192 [GNOME libgsf até 1.14.60 OLE2 Parser gsf/gsf-infile-msole.c ole_info_read_metabat Excesso de tampão] |
|---|
| Pontos | 20 |
|---|