CVE-2026-110602: libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must cause the application to process a malicious KWAJ file. The file can be truncated, empty, or contain an invalid signature, provided it triggers a header-read error in kwajd_open().
What is the likely impact for an affected application?
Processing the crafted file can crash the process. The flaw may also provide an arbitrary-free memory-corruption primitive, which can have more serious consequences depending on the application and its runtime environment.
How can I determine whether my application is exposed?
Applications are exposed if they use libmspack through 0.11alpha and can open or parse attacker-controlled KWAJ files. Review file-upload, import, attachment-processing, and automated ingestion paths that pass KWAJ content to libmspack.