Skip to content
OpenAdvisories
High ALAS2-2026-4106 1 CVE

Important: libgsf security update (Amazon Linux 2)

Published Nov 12, 2026 · Updated Nov 12, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-116124: A flaw was found in libgsf. A heap-based buffer overflow vulnerability exists in the OLE2 document parser within the ole_info_read_metabat function. A remote attacker could exploit this flaw by enticing a user to open a specially crafted file. Successful exploitation could lead to arbitrary code execution or cause an application crash, resulting in a Denial of Service (DoS).

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 libgsf 0:1.14.26-7.amzn2.0.4
Amazon Linux · 2 libgsf-debuginfo 0:1.14.26-7.amzn2.0.4
Amazon Linux · 2 libgsf-devel 0:1.14.26-7.amzn2.0.4

Vulnerabilities 1

  • Medium 6.3
    CVE-2026-116124

    GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow

    A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The att…

    GNOME libgsf libgsf libgsf Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-116124.html