CVE-2026-111134: libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use affected libfwsi versions to parse MTP file entry shell items from .lnk files, jump lists, or shell bags are exposed. The issue can cause those libfwsi consumers to crash.
What does an attacker need to exploit it?
An attacker needs to provide a crafted .lnk file, jump list, or shell bag containing an MTP file entry shell item. The shell item can be 10 to 73 bytes long and have item data sized at 44 bytes or more.
Is user interaction required?
Yes. The supplied CVSS vector includes UI:R, indicating that a user or another workflow must cause the vulnerable consumer to process the crafted artifact.