{"id":"CVE-2026-116743","kind":"vulnerability","aliases":["CVE-2026-116743"],"related":[],"title":"libmsiecf: double free in URL record parsing lets crafted index.dat corrupt heap","description":"libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.","summary":"libmsiecf, a libyal library for reading Microsoft Internet Explorer cache index.dat files, has a double free in libmsiecf_url_values_read_data(). A crafted index.dat with a partial URL record and an oversized unknown_offset corrupts heap memory and crashes forensic tools that parse it.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","forensics","libmsiecf","package"],"not_affected_if":["no-msie-cache-parsing"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:51+00:00","updated_at":"2026-10-26T22:27:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T22:27:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"libmsiecf: double free in URL record parsing lets crafted index.dat corrupt heap","impact":"medium","summary":"libmsiecf, a libyal library for reading Microsoft Internet Explorer cache index.dat files, has a double free in libmsiecf_url_values_read_data(). A crafted index.dat with a partial URL record and an oversized unknown_offset corrupts heap memory and crashes forensic tools that parse it.","category":"package","nicknames":[],"who_cares":["forensics","libmsiecf","c"],"confidence":0.5,"needs_auth":"no","worst_case":"heap corruption crashes parser; code execution not stated in sources","analyst_note":"Check the libyal/libmsiecf project and the NVD entry for a fixed version and whether heap corruption can lead to code execution.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-msie-cache-parsing"],"who_is_affected":"Teams that run forensic or analysis tooling built on libmsiecf that parse untrusted MSIE index.dat files. Systems that never process index.dat files from untrusted sources are unlikely to be exposed. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000569,"input_tokens":3343,"output_tokens":470,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116743':15A,18A '-2026':14A,17A '20260525':70C 'allow':83C 'attack':84C,94C 'c':19B 'cach':32B,100C 'contain':71C 'corrupt':11A,58B,86C 'craft':9A,46B,90C,98C 'crash':62B,112C 'cve':13A,16A 'data':44B,81C 'doubl':2A,37B,73C 'explor':31B 'file':34B,102C 'forens':20B,63B,113C 'free':3A,38B,74C 'heap':12A,59B,87C 'index.dat':10A,33B,47B,101C 'internet':30B 'let':8A 'libmsiecf':1A,21B,23B,40B,68C,77C 'librari':26B 'libyal':25B,67C 'memori':60B,88C 'microsoft':29B 'msie':99C 'offset':57B,111C 'overs':55B,109C 'packag':22B 'pars':7A,66B 'partial':50B,91C,105C 'process':115C 'read':28B,43B,80C 'record':6A,52B,93C,106C 'recov':104C 'suppli':96C 'tool':64B,114C 'unknown':56B,110C 'url':5A,41B,51B,78C,92C 'valu':42B,79C 'via':89C 'vulner':75C 'whose':103C","nicknames":[],"mitigations":[],"who_affected":"Teams that run forensic or analysis tooling built on libmsiecf that parse untrusted MSIE index.dat files. Systems that never process index.dat files from untrusted sources are unlikely to be exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116743","severity":null,"published_at":"2026-10-26T22:16:58+00:00","modified_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}