CVE-2026-110602: libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
Other sources
libmspack through 0.11alpha Uninitialized Pointer Free via kwajdopen Error Path
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libmspackto a version that resolves this vulnerability.Fixed in 0.11-2 - Upgrade
Upgrade
ubuntu/libmspackto a version that resolves this vulnerability.Fixed in 0.10.1-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/libmspackto a version that resolves this vulnerability.Fixed in 0.11-1.1ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/libmspackto a version that resolves this vulnerability.Fixed in 0.11-1.1ubuntu0.26.10.1 - Upgrade
Upgrade
ubuntu/libmspackto a version that resolves this vulnerability.Fixed in 0.11-1.1ubuntu0.26.04.1
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must cause the application to process a malicious KWAJ file. The file can be truncated, empty, or contain an invalid signature, provided it triggers a header-read error in kwajd_open().
What is the likely impact for an affected application?
Processing the crafted file can crash the process. The flaw may also provide an arbitrary-free memory-corruption primitive, which can have more serious consequences depending on the application and its runtime environment.
How can I determine whether my application is exposed?
Applications are exposed if they use libmspack through 0.11alpha and can open or parse attacker-controlled KWAJ files. Review file-upload, import, attachment-processing, and automated ingestion paths that pass KWAJ content to libmspack.