CVE-2026-119602

24th percentile - higher than 24% of all known CVEs

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.

An attacker could gain access to sensitive heap memory data, potentially leading to information disclosure such as fragments of other files or process data.

Update libmspack to a version containing the fix. Avoid processing untrusted CAB files without prior validation.