Libextractor (< 1.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/libextractor--1.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 25 Sep 2026 20:55:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Code Execution in GNU libextractor via Environment Variable Injectionhttps://feed.craftedsignal.io/briefs/2026-09-libextractor-rce/Fri, 25 Sep 2026 20:55:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-libextractor-rce/GNU libextractor versions prior to 1.16 are vulnerable to arbitrary code execution due to the insecure handling of the LIBEXTRACTOR_PREFIX environment variable, which can be leveraged by local attackers for privilege escalation.GNU libextractor before version 1.16 contains a vulnerability where the library fails to properly validate the LIBEXTRACTOR_PREFIX environment variable when searching for plugins. Because this variable influences the library's plugin loading path, a local attacker can set it to a directory they control. If a setuid or setgid binary utilizes libextractor, the library will load and execute malicious plugins located in the attacker-supplied directory with the privileges of the binary. This vulnerability allows an attacker to achieve privilege escalation on the host system. This is particularly critical in environments where setuid/setgid binaries are commonly used or where libextractor is embedded in privileged services.

Impact

Successful exploitation of this vulnerability enables a local attacker to execute arbitrary code with elevated privileges. This could lead to a full system compromise, data theft, or persistence on the affected host. The scope is limited to systems where libextractor is utilized by setuid or setgid programs.

Recommendation

  • Upgrade libextractor to version 1.16 or later immediately to address the insecure environment variable handling.
  • Audit existing setuid and setgid binaries on Linux systems to determine if they are linked against the affected libextractor library.
  • Implement environment variable sanitization policies for high-privilege service accounts to prevent the injection of arbitrary paths into library search variables.
]]>highadvisoryprivilege-escalationlinuxvulnerability