libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.3 · kyzNVD modified 2026-10-30 13:18
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/kyz/libmspack/issues/60 issue-tracking
- https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/mszipd.c#L264-L276 technical-description
- https://hackmd.io/@haindpwn/libmspack-mszip-uninit-window-info-leak third-party-advisory
- https://github.com/kyz/libmspack product
- https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-memory-disclosure-via-ms-zip-decompressor-window third-party-advisory