The vulnerability CVE-2026-1767 affects the tracker-extract-mp3 component of GNOME localsearch in Red Hat Enterprise Linux 10. A remote attacker can exploit this heap buffer overflow by supplying a malicious MP3 file with malformed ID3 tags. The incorrect length calculation during parsing of performer tags results in reading beyond the allocated buffer boundaries. This can cause a denial of service due to a crash or potentially leak information. The CVSS 3.1 base score is 5.6 (medium severity) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H, indicating local attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. No official patch or remediation level is currently stated in the vendor advisory. No known exploits in the wild have been reported.

Successful exploitation can cause a denial of service by crashing the affected component or potentially disclose information due to reading beyond buffer boundaries. The confidentiality impact is low, integrity impact is none, and availability impact is high. The attack requires local access with low privileges and user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1767 for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed MP3 files with the tracker-extract-mp3 component. No official workaround or temporary fix is documented in the advisory.