CVE-2026-111135: libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpvolumevaluesreaddata() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.
Affected Software
Event History
Frequently Asked Questions
What attacker-controlled content is required to trigger the issue?
An attacker needs to supply a crafted MTP volume shell item embedded in a .lnk file, jump list, or shell bag. The shell item can be 10 to 53 bytes long and must declare item data of at least 44 bytes.
What is the practical impact described for affected consumers?
Processing the crafted artifact can cause a consuming process to crash due to a heap out-of-bounds read. The provided information describes denial of service and does not establish code execution or data modification.
Which systems are exposed?
Systems are exposed when a process uses libfwsi to parse untrusted or attacker-influenced .lnk files, jump lists, or shell bags containing MTP volume shell items. Exploitation requires local attack vector conditions and user interaction, according to the supplied CVSS vector.