This vulnerability exists in the tracker-extract-mp3 component of GNOME localsearch, where improper length handling of malformed ID3 performer tags in MP3 files leads to a heap buffer overflow. A local attacker with low privileges can exploit this by providing a crafted MP3 file, causing a read beyond the allocated buffer. The impact includes potential denial of service via application crash or information disclosure. The vulnerability affects Red Hat Enterprise Linux 10. No explicit patch or remediation level is stated in the vendor advisory, and no known exploits are reported in the wild as of the publication date.

Successful exploitation can result in denial of service due to application crashes or information disclosure from reading beyond buffer boundaries. The CVSS vector indicates local attack vector, low complexity, low privileges required, user interaction needed, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1767 for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor advisory for updates and apply patches once available.