CVE-2026-100310
Description
A flaw was found in libextractor. When executed by privileged applications, such as those running with elevated set user ID (setuid) permissions, the library loads plugins from an untrusted search path defined by the LIBEXTRACTOR_PREFIX environment variable without verifying caller privileges. A local attacker can exploit this issue by pointing the variable to a directory containing a crafted plugin, leading to arbitrary code execution with elevated privileges.
Statement
This issue does not affect any Red Hat product. The libextractor package is only available in Fedora community repositories.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
