Vulnerability in Kyz Libmspack
CVE-2026-110602
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f (patch)
- github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c (technical-description)
- hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free (third-party-advisory)
- www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-110602?
- CVE-2026-110602 is a medium-severity vulnerability in Kyz Libmspack, classified under Access of Uninitialized Pointer. CVSS score: 6.3/10. Published 2026-10-14.
- How severe is CVE-2026-110602?
- Medium severity. CVSS v3 base score is 6.3 out of 10.