Live › vulnerability › CVE-2026-119602
libmspack is a library for reading Microsoft CAB archives. A crafted MS-ZIP compressed CAB file makes the decompressor write up to 32 KiB of stale heap memory into extracted output, leaking data from the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Systems that use libmspack to extract CAB archives that may come from untrusted sources, such as upload handlers or mail and document processing. Applications that never extract untrusted CAB files face little exposure. The sources do not name a fixed version.
No product ranges from the sources yet.
dpkg -s libmspack0 or pkg-config --modversion libmspackNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
This page as .md · .json · in your agent: get_signal("CVE-2026-119602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.