SZB-3576f1d4d5
EUVD-2026-113939 reports uninitialized memory disclosure in libmspack
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- kyz
- Product
- libmspack
- First seen
Summary
The EUVD listing, citing a CVSS v3.1 score of 6.3, says libmspack through 0.11alpha leaks heap data through its MS-ZIP decompressor. The leak is triggered by a crafted CAB file with unchecked back-reference distances.
If you use kyz
Check libmspack for a fixed release after 0.11alpha
Upgrade libmspack once a patched version is available
Decompress CAB files only from trusted sources until patched
What the sources say 1
· Mastodon: “libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances.” Source