CVE-2026-116124
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-116124 is a moderate vulnerability with a CVSS score of 6.3 affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.
Attack Chain
Attacker identifies vulnerable service instances using Shodan, Censys, or active scanning
Attacker crafts malicious payload exploiting CVE-2026-116124 to achieve remote code execution
Attacker executes arbitrary OS commands or shellcode in the context of the vulnerable process
Attacker installs backdoor, cron job, or web shell for persistent access
Attacker uses compromised host as pivot point to access internal network resources
MITRE ATT&CK Techniques
Attacker exploits the vulnerability in an internet-facing service to gain initial access
Post-exploitation shell commands executed through the vulnerability
Attacker downloads malware or tools after gaining code execution
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against application endpoint — monitor access logs for anomalous params |
Remediation
Quick Facts
| CVE ID | CVE-2026-116124 |
| CVSS Score | 6.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| Published | 2026-10-26 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |