CVE-2026-111134 Details
Description
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.
A heap out-of-bounds read vulnerability has been identified in the libfwsi library, specifically in the MTP file entry value parser. This vulnerability allows attackers to read beyond buffer limits by crafting MTP file entry shell items. The issue arises from improper handling of item data sizes, enabling reads of up to 64 bytes past the allocated buffer. The vulnerability is present in libfwsi versions through 20260522.
Users are advised to update to the latest version of libfwsi, where this vulnerability has been addressed. For those using an affected version, it is recommended to avoid parsing untrusted shell items until the vulnerability can be mitigated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libfwsi | <= 20260522 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |