---
id: "CVE-2026-116743"
kind: "vulnerability"
aliases: ["CVE-2026-116743"]
title: "libmsiecf: double free in URL record parsing lets crafted index.dat corrupt heap"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "forensics", "libmsiecf", "package"]
not_affected_if: ["no-msie-cache-parsing"]
published_at: "2026-10-26T22:16:58+00:00"
first_seen_at: "2026-10-26T22:25:34+00:00"
updated_at: "2026-10-26T22:27:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116743", "first_seen_at": "2026-10-26T22:25:34+00:00"}]
---

# libmsiecf: double free in URL record parsing lets crafted index.dat corrupt heap

libmsiecf, a libyal library for reading Microsoft Internet Explorer cache index.dat files, has a double free in libmsiecf_url_values_read_data(). A crafted index.dat with a partial URL record and an oversized unknown_offset corrupts heap memory and crashes forensic tools that parse it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T22:25:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116743

## From the sources

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_