CVE-2026-116124

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-116124

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116124.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-116124

Downstream

Published

2026-10-26T06:00:16Z

Modified

2026-10-31T07:04:46Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow

Details

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116124.json"
}

References

Affected packages

Git / gitlab.gnome.org/gnome/libgsf

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/gnome/libgsf

Events

Introduced

c71e01525465edb1dc8289854f7120eeccf21186

Fixed

a8e25560b74f84c3f86df6ca0ac59195fa5af68a

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.14.0"
                },
                {
                    "last_affected": "1.14.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.1"
                },
                {
                    "last_affected": "1.14.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.2"
                },
                {
                    "last_affected": "1.14.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.3"
                },
                {
                    "last_affected": "1.14.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.4"
                },
                {
                    "last_affected": "1.14.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.5"
                },
                {
                    "last_affected": "1.14.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.6"
                },
                {
                    "last_affected": "1.14.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.7"
                },
                {
                    "last_affected": "1.14.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.8"
                },
                {
                    "last_affected": "1.14.8"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.9"
                },
                {
                    "last_affected": "1.14.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.10"
                },
                {
                    "last_affected": "1.14.10"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.11"
                },
                {
                    "last_affected": "1.14.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.12"
                },
                {
                    "last_affected": "1.14.12"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.13"
                },
                {
                    "last_affected": "1.14.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.14"
                },
                {
                    "last_affected": "1.14.14"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.15"
                },
                {
                    "last_affected": "1.14.15"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.16"
                },
                {
                    "last_affected": "1.14.16"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.17"
                },
                {
                    "last_affected": "1.14.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.18"
                },
                {
                    "last_affected": "1.14.18"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.19"
                },
                {
                    "last_affected": "1.14.19"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.20"
                },
                {
                    "last_affected": "1.14.20"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.21"
                },
                {
                    "last_affected": "1.14.21"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.22"
                },
                {
                    "last_affected": "1.14.22"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.23"
                },
                {
                    "last_affected": "1.14.23"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.24"
                },
                {
                    "last_affected": "1.14.24"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.25"
                },
                {
                    "last_affected": "1.14.25"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.26"
                },
                {
                    "last_affected": "1.14.26"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.27"
                },
                {
                    "last_affected": "1.14.27"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.28"
                },
                {
                    "last_affected": "1.14.28"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.29"
                },
                {
                    "last_affected": "1.14.29"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.30"
                },
                {
                    "last_affected": "1.14.30"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.31"
                },
                {
                    "last_affected": "1.14.31"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.32"
                },
                {
                    "last_affected": "1.14.32"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.33"
                },
                {
                    "last_affected": "1.14.33"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.34"
                },
                {
                    "last_affected": "1.14.34"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.35"
                },
                {
                    "last_affected": "1.14.35"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.36"
                },
                {
                    "last_affected": "1.14.36"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.37"
                },
                {
                    "last_affected": "1.14.37"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.38"
                },
                {
                    "last_affected": "1.14.38"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.39"
                },
                {
                    "last_affected": "1.14.39"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.40"
                },
                {
                    "last_affected": "1.14.40"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.41"
                },
                {
                    "last_affected": "1.14.41"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.42"
                },
                {
                    "last_affected": "1.14.42"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.43"
                },
                {
                    "last_affected": "1.14.43"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.44"
                },
                {
                    "last_affected": "1.14.44"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.45"
                },
                {
                    "last_affected": "1.14.45"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.46"
                },
                {
                    "last_affected": "1.14.46"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.47"
                },
                {
                    "last_affected": "1.14.47"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.48"
                },
                {
                    "last_affected": "1.14.48"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.49"
                },
                {
                    "last_affected": "1.14.49"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.50"
                },
                {
                    "last_affected": "1.14.50"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.51"
                },
                {
                    "last_affected": "1.14.51"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.52"
                },
                {
                    "last_affected": "1.14.52"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.53"
                },
                {
                    "last_affected": "1.14.53"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.54"
                },
                {
                    "last_affected": "1.14.54"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.55"
                },
                {
                    "last_affected": "1.14.55"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.56"
                },
                {
                    "last_affected": "1.14.56"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.57"
                },
                {
                    "last_affected": "1.14.57"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.58"
                },
                {
                    "last_affected": "1.14.58"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.59"
                },
                {
                    "last_affected": "1.14.59"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.14.60"
                },
                {
                    "last_affected": "1.14.60"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "a8e25560b74f84c3f86df6ca0ac59195fa5af68a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.14.0

1.14.1

1.14.10

1.14.11

1.14.12

1.14.13

1.14.14

1.14.15

1.14.16

1.14.17

1.14.18

1.14.19

1.14.2

1.14.20

1.14.21

1.14.22

1.14.23

1.14.24

1.14.25

1.14.26

1.14.27

1.14.28

1.14.29

1.14.3

1.14.30

1.14.31

1.14.32

1.14.33

1.14.34

1.14.35

1.14.36

1.14.37

1.14.38

1.14.39

1.14.4

1.14.40

1.14.41

1.14.42

1.14.43

1.14.44

1.14.45

1.14.46

1.14.47

1.14.48

1.14.49

1.14.5

1.14.50

1.14.51

1.14.52

1.14.53

1.14.54

1.14.55

1.14.56

1.14.57

1.14.58

1.14.59

1.14.6

1.14.60

1.14.7

1.14.8

1.14.9

Other

LIBGSF_1_13_99

LIBGSF_1_14_0

LIBGSF_1_14_1

LIBGSF_1_14_10

LIBGSF_1_14_11

LIBGSF_1_14_12

LIBGSF_1_14_13

LIBGSF_1_14_14

LIBGSF_1_14_15

LIBGSF_1_14_16

LIBGSF_1_14_17

LIBGSF_1_14_18

LIBGSF_1_14_19

LIBGSF_1_14_2

LIBGSF_1_14_20

LIBGSF_1_14_21

LIBGSF_1_14_22

LIBGSF_1_14_23

LIBGSF_1_14_24

LIBGSF_1_14_25

LIBGSF_1_14_26

LIBGSF_1_14_27

LIBGSF_1_14_28

LIBGSF_1_14_29

LIBGSF_1_14_3

LIBGSF_1_14_30

LIBGSF_1_14_31

LIBGSF_1_14_32

LIBGSF_1_14_33

LIBGSF_1_14_34

LIBGSF_1_14_35

LIBGSF_1_14_36

LIBGSF_1_14_37

LIBGSF_1_14_38

LIBGSF_1_14_39

LIBGSF_1_14_4

LIBGSF_1_14_40

LIBGSF_1_14_41

LIBGSF_1_14_42

LIBGSF_1_14_43

LIBGSF_1_14_44

LIBGSF_1_14_45

LIBGSF_1_14_46

LIBGSF_1_14_47

LIBGSF_1_14_48

LIBGSF_1_14_49

LIBGSF_1_14_5

LIBGSF_1_14_50

LIBGSF_1_14_51

LIBGSF_1_14_52

LIBGSF_1_14_53

LIBGSF_1_14_54

LIBGSF_1_14_55

LIBGSF_1_14_56

LIBGSF_1_14_57

LIBGSF_1_14_58

LIBGSF_1_14_59

LIBGSF_1_14_6

LIBGSF_1_14_7

LIBGSF_1_14_8

LIBGSF_1_14_9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116124.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "111560863161694318335803755981540519085",
                "152703572673130119477664053470292837151",
                "46457647483451121612549774486031012259",
                "54665570327432362928548380770866698944",
                "8302070413433805515457459802899461336",
                "14133246775091251633378083288344319898",
                "44995124767161992341709820340168423543",
                "290370959057881316827751970305005398388",
                "103300234777739190848415276115336370448"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116124-1e381f65",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libgsf@a8e25560b74f84c3f86df6ca0ac59195fa5af68a",
        "target": {
            "file": "gsf/gsf-infile-msole.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "38546192357615753673988118724441787341",
            "length": 1010
        },
        "id": "CVE-2026-116124-9f010807",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libgsf@a8e25560b74f84c3f86df6ca0ac59195fa5af68a",
        "target": {
            "file": "gsf/gsf-infile-msole.c",
            "function": "ole_info_get_sb_file"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "91894255903509083633534011599692404098",
            "length": 4603
        },
        "id": "CVE-2026-116124-b512941f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libgsf@a8e25560b74f84c3f86df6ca0ac59195fa5af68a",
        "target": {
            "file": "gsf/gsf-infile-msole.c",
            "function": "ole_init_info"
        }
    }
]

vanir_signatures_modified

"2026-10-31T07:04:46Z"