{"id":"CVE-2026-119602","kind":"vulnerability","aliases":["CVE-2026-119602"],"related":[],"title":"libmspack: crafted CAB file leaks heap memory during MS-ZIP extraction","description":"libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.","summary":"libmspack is a library for reading Microsoft CAB archives. A crafted MS-ZIP compressed CAB file makes the decompressor write up to 32 KiB of stale heap memory into extracted output, leaking data from the process.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","cab-extraction","libmspack","package"],"not_affected_if":["no-untrusted-cab-input"],"how_to_check":"- Check the installed libmspack version against the affected range (through 0.11alpha), e.g. `dpkg -s libmspack0` or `pkg-config --modversion libmspack`\n- Find programs or services that link libmspack and extract untrusted CAB files, unknown for the exact list","fix":null,"status":"open","published_at":"2026-10-30T14:16:48+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:49+00:00","updated_at":"2026-10-30T14:32:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T14:32:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"libmspack: crafted CAB file leaks heap memory during MS-ZIP extraction","impact":"low","summary":"libmspack is a library for reading Microsoft CAB archives. A crafted MS-ZIP compressed CAB file makes the decompressor write up to 32 KiB of stale heap memory into extracted output, leaking data from the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["libmspack","cab-extraction","c"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap memory contents leak into extracted output, possibly including secrets.","analyst_note":"Confirm a fixed libmspack version and whether the flaw is exploitable via untrusted CAB input; check the upstream project and NVD entry.","how_to_check":"- Check the installed libmspack version against the affected range (through 0.11alpha), e.g. `dpkg -s libmspack0` or `pkg-config --modversion libmspack`\n- Find programs or services that link libmspack and extract untrusted CAB files, unknown for the exact list","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-cab-input"],"who_is_affected":"Systems that use libmspack to extract CAB archives that may come from untrusted sources, such as upload handlers or mail and document processing. Applications that never extract untrusted CAB files face little exposure. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4168,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119602':15A,18A '-2026':14A,17A '0.11':64C '32':48B,117C 'allow':79C 'alpha':65C 'archiv':33B 'attack':80C,91C 'back':88C,108C 'back-refer':87C,107C 'begin':104C 'block':103C 'c':19B 'cab':3A,21B,32B,40B,99C 'cab-extract':20B 'cabd':111C 'caus':110C 'compress':39B 'contain':66C 'craft':2A,35B,95C 'cve':13A,16A 'data':58B,84C 'decompressor':44B,77C 'disclosur':70C 'distanc':90C 'extract':12A,22B,55B,112C,124C 'file':4A,41B,100C 'first':102C 'heap':6A,52B,83C,121C 'kib':49B,118C 'leak':5A,57B,82C 'libmspack':1A,23B,25B,62C 'librari':28B 'make':42B 'memori':7A,53B,69C,122C 'microsoft':31B 'ms':10A,37B,75C,97C 'ms-zip':9A,36B,74C,96C 'output':56B,125C 'packag':24B 'process':61B 'read':30B 'refer':89C,109C 'stale':51B,120C 'suppli':93C 'uncheck':86C 'uniniti':68C 'via':85C 'vulner':71C 'whose':101C 'write':45B,114C 'zip':11A,38B,76C,98C","nicknames":[],"mitigations":[],"who_affected":"Systems that use libmspack to extract CAB archives that may come from untrusted sources, such as upload handlers or mail and document processing. Applications that never extract untrusted CAB files face little exposure. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T14:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119602","severity":null,"published_at":"2026-10-30T14:16:48+00:00","modified_at":"2026-10-30T14:16:48+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}