CVE-2026-119602 Details
Description
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
A vulnerability allowing uninitialized memory disclosure has been identified in libmspack versions through 0.11alpha, specifically within the MS-ZIP decompressor. This issue arises because the decompressor does not properly validate back-reference distances, allowing attackers to leak heap data. By crafting a specific MS-ZIP CAB file that includes a back-reference in the first block, an attacker can exploit this vulnerability. The cabd->extract() function will then inadvertently write up to 32 KiB of uninitialized heap memory into the extracted output.
The vulnerability has been addressed in the upcoming release of libmspack. Users can apply the patch by adding a memset() call to initialize the MS-ZIP window after allocation, and by implementing distance validation to reject back-references that exceed the total bytes decoded.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kyz/libmspack | [email protected] | ProductSource CodeVendor |
| https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/mszipd.c#L264-L276 | [email protected] | |
| https://github.com/kyz/libmspack/issues/60 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/libmspack-mszip-uninit-window-info-leak | [email protected] | Technical Analysis |
| https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-memory-disclosure-via-ms-zip-decompressor-window | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libmspack | <= 0.11alpha |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |