This vulnerability involves a heap buffer overflow in the tracker-extract-mp3 component of GNOME localsearch (formerly tracker-miners) on Red Hat Enterprise Linux 10. When processing maliciously crafted MP3 files, the flaw can be exploited by a local attacker with limited privileges and requiring user interaction to cause the application to crash, resulting in Denial of Service. Additionally, there is a potential for sensitive information disclosure from system memory. The CVSS 3.1 base score is 5.6, reflecting a medium severity with local attack vector, low complexity, low privileges required, and user interaction needed.

Successful exploitation can cause the tracker-extract-mp3 process to crash, resulting in Denial of Service. There is also a potential risk of sensitive information disclosure from system memory due to the heap buffer overflow. The vulnerability requires local access with low privileges and user interaction, limiting the attack scope.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1765 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply patches once available.