CVE-2026-100310— GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Quick assessment
Affected
GNU libextractor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GNU libextractor 在 1.16 版本之前，会从由 LIBEXTRACTOR_PREFIX 环境变量指定的不受信任的搜索路径中加载插件，且未进行适当的权限检查。本地攻击者可以通过将 LIBEXTRACTOR_PREFIX 设置为包含恶意插件的目录来利用此漏洞。当该插件被以 setuid 或 setgid 权限运行的程序加载时，将执行任意代码并提升权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100310
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Source: CVE Program / CVE List V5
Vulnerability Description
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可信的搜索路径
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GNU | libextractor | 0 ~ 1.16 | - |
|
II. Public POCs for CVE-2026-100310
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100310
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100310 (1)
Vendor Pages for CVE-2026-100310 (1)
Other References for CVE-2026-100310 (3)
-
https://ftp.gnu.org/gnu/libextractor/ release-notes
IV. Related Vulnerabilities
Same vendor: GNU
-
CVE-2026-96269
Emacs 28.1-31.1 read-symbol-shorthands远程代码执行漏洞 -
CVE-2026-91782
GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x -
CVE-2026-91781
GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_se -
CVE-2026-91780
GNU Binutils elflink.c elf_link_add_object_symbols null poin -
CVE-2026-91779
GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_secti
Same weakness: CWE-426
-
CVE-2026-87723
Untrusted Search Path (PATH Hijacking) in fuse-archive -
CVE-2026-100584
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shad -
CVE-2026-68492
Plesk 18.0.34-18.0.81 路径遍历漏洞 -
CVE-2026-92587
n8n before 1.123.76 Sandbox Escape via Git Relative URL -
CVE-2026-0307
GlobalProtect App: Local Privilege Escalation Vulnerabilitie
V. Comments for CVE-2026-100310
No comments yet