This vulnerability involves a heap buffer overflow in the tracker-extract-mp3 component of GNOME localsearch when handling malformed ID3v2.3 COMM tags in MP3 files. An attacker supplying a crafted MP3 file could trigger a denial of service by crashing the application and potentially leak sensitive information from heap memory. The issue affects Red Hat Enterprise Linux 10. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and user interaction, impacting availability and confidentiality to a limited extent. No official patch or remediation level is stated in the vendor advisory.

Successful exploitation results in denial of service due to application crash and may disclose sensitive information from heap memory. The impact on confidentiality is limited, and integrity is not affected. The attack requires local access with low privileges and user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1766 for current remediation guidance. Until a fix is available, avoid processing untrusted or specially crafted MP3 files with the affected component. Monitor the vendor advisory for updates on patches or workarounds.