CVE-2026-116743: libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecfurlvaluesreaddata() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknownoffset, crashing forensic tools processing it.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Forensic tools or workflows that use libmsiecf to process attacker-supplied or otherwise untrusted MSIE cache index.dat files are exposed. The described trigger occurs while processing recovered partial URL records.
What does an attacker need to provide to trigger the vulnerability?
An attacker needs to supply a crafted MSIE cache index.dat file containing a recovered partial URL record with an oversized unknown_offset. Processing that file can cause heap-memory corruption and crash the affected tool.
How can I determine whether my deployment may be affected?
Check whether the deployment uses libyal libmsiecf through version 20260525 and processes MSIE cache index.dat files. Risk is especially relevant if those files can originate from untrusted sources or forensic evidence.
What is the expected impact of successful exploitation?
The reported outcome is heap-memory corruption leading to a crash of the forensic tool. The supplied severity vector indicates an availability impact, with no reported confidentiality or integrity impact.