CVE-2026-100310

Name of the Vulnerable Software and Affected Versions GNU libextractor versions prior to 1.16

Description The software loads plugins from an untrusted search path defined by the LIBEXTRACTOR PREFIX environment variable without performing proper privilege checks. A local attacker can manipulate the LIBEXTRACTOR PREFIX variable to point to a directory containing a malicious plugin. When a setuid or setgid program loads this plugin, it allows the execution of arbitrary code with elevated privileges.

Recommendations Update GNU libextractor to version 1.16 or later.