Live › vulnerability › CVE-2026-116743
Go to dashboardlibmsiecf, a libyal library for reading Microsoft Internet Explorer cache index.dat files, has a double free in libmsiecf_url_values_read_data(). A crafted index.dat with a partial URL record and an oversized unknown_offset corrupts heap memory and crashes forensic tools that parse it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Teams that run forensic or analysis tooling built on libmsiecf that parse untrusted MSIE index.dat files. Systems that never process index.dat files from untrusted sources are unlikely to be exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
This page as .md · .json · in your agent: get_signal("CVE-2026-116743")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.