GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.

GNU libextractor versions before 1.15 contain a stack-based buffer overflow vulnerability in the process_star_office function. The vulnerability arises because a variable-length stack array is sized using attacker-controlled data from OLE2 streams. Attackers can craft malicious StarOffice documents that cause up to 4 MB of stack allocation, leading to stack overflow. The result is a crash of any application that attempts to extract metadata from such a crafted document. This represents a denial-of-service risk and potentially more severe impact depending on the application context. A fix has been committed to the GNUnet repository. A proof-of-concept exploit repository is publicly available on GitHub, increasing the risk of exploitation. Users are advised to upgrade to libextractor 1.15 or later.