CVE-2026-110602 Details
Description
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
A vulnerability allowing uninitialized pointer free has been identified in libmspack versions through 0.11alpha, specifically within the KWAJ decompressor. The issue arises in the 'kwajd_open' function, located in 'mspack/kwajd.c'. When the function encounters header read errors, it frees pointers for filenames and extra data that were not properly initialized. This flaw can be exploited by supplying a truncated, empty, or incorrectly signed KWAJ file, leading to a process crash or allowing for arbitrary memory corruption.
Users are advised to update to the latest version of libmspack, where this vulnerability has been addressed. The recommended fix involves initializing the 'filename' and 'extra' pointers to NULL immediately after allocating the header, before any header data is read.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free | CISA-ADP | Technical Analysis |
| https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181 | [email protected] | Source CodeVendor |
| https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f | [email protected] | Source CodeVendor |
| https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free | [email protected] | Technical Analysis |
| https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-824 | Access of Uninitialized Pointer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libmspack | <= 0.11alpha |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |