| Title | GNOME libgsf e3958edf77af1374118c278eb772e51c6fdbe235 Heap-based Buffer Overflow |
|---|
| Description | libgsf 1.14.60 (and current Git master as verified) contains a heap-based out-of-bounds write in gsf/gsf-infile-msole.c when parsing a crafted OLE2/Compound Document file. The small-block BAT size is calculated from attacker-controlled meta_sbat.num_blocks multiplied by the number of BAT entries per sector. The product is assigned to a guint32 num_blocks field, truncating values above UINT32_MAX. The truncated value is used to allocate sb.bat.block, but ole_info_read_metabat() then iterates over all entries described by the untruncated meta_sbat chain and writes BAT entries without checking the destination buffer bounds. This causes a heap buffer overflow with file-controlled 32-bit values. The flaw is reachable through the normal OLE2 parsing path and can be triggered with the stock gsf CLI. A non-sanitized build crashes deterministically with SIGSEGV. The demonstrated impact is heap corruption and denial of service. |
|---|
| Source | ⚠️ https://gitlab.gnome.org/GNOME/libgsf/-/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a |
|---|
| User | suyuanwang (UID 101634) |
|---|
| Submission | 09/29/2026 11:52 (1 month ago) |
|---|
| Moderation | 10/25/2026 10:25 (26 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426192 [GNOME libgsf up to 1.14.60 OLE2 Parser gsf/gsf-infile-msole.c ole_info_read_metabat heap-based overflow] |
|---|
| Points | 20 |
|---|