This vulnerability involves a heap buffer overflow in the tracker-extract-mp3 component of GNOME localsearch (formerly tracker-miners) on Red Hat Enterprise Linux 10. When processing maliciously crafted MP3 files, the flaw can be triggered, potentially leading to application crashes (denial of service) and limited exposure of sensitive information from system memory. The CVSS 3.1 base score is 5.6, reflecting medium severity with local attack vector, low complexity, requiring privileges and user interaction, and resulting in partial confidentiality loss and high availability impact. No official remediation level or patch information is provided in the vendor advisory at this time.

A remote attacker with local access and user interaction can exploit this vulnerability by providing a crafted MP3 file to the vulnerable component. This can cause the application to crash, resulting in denial of service. Additionally, there is potential for limited disclosure of sensitive information from system memory. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1765 for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, avoid processing untrusted MP3 files with the affected component.