---
id: "CVE-2026-119602"
kind: "vulnerability"
aliases: ["CVE-2026-119602"]
title: "libmspack: crafted CAB file leaks heap memory during MS-ZIP extraction"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "cab-extraction", "libmspack", "package"]
not_affected_if: ["no-untrusted-cab-input"]
published_at: "2026-10-30T14:16:48+00:00"
first_seen_at: "2026-10-30T14:30:54+00:00"
updated_at: "2026-10-30T14:32:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119602", "first_seen_at": "2026-10-30T14:30:54+00:00"}]
---

# libmspack: crafted CAB file leaks heap memory during MS-ZIP extraction

libmspack is a library for reading Microsoft CAB archives. A crafted MS-ZIP compressed CAB file makes the decompressor write up to 32 KiB of stale heap memory into extracted output, leaking data from the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed libmspack version against the affected range (through 0.11alpha), e.g. `dpkg -s libmspack0` or `pkg-config --modversion libmspack`
- Find programs or services that link libmspack and extract untrusted CAB files, unknown for the exact list

## Timeline

- 2026-10-30T14:30:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119602

## From the sources

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_