CVE-2026-110602

MediumCVSS 6.3

Published: 14/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

Risk Assessment

An attacker can remotely crash an application processing KWAJ files, causing denial of service (DoS) and potential memory corruption leading to further exploits.

Recommendation

Upgrade libmspack beyond 0.11alpha if available, or implement validation of KWAJ files for correct signature and completeness before processing. Consider restricting processing of untrusted files.

Other vulnerabilities in libmspack

CVE-2026-119602Low
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS