CVE-2026-119602: libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window

Q: Which deployments are exposed?

Deployments that use libmspack to extract MS-ZIP CAB files from attacker-controlled or otherwise untrusted sources are exposed. The affected component is the MS-ZIP decompressor.

Q: What does an attacker need to provide?

An attacker needs to supply a crafted MS-ZIP CAB file whose first block begins with a back-reference. No attacker privileges or user interaction are indicated in the supplied severity data.

Q: What is disclosed if exploitation succeeds?

The extracted output can contain stale heap memory from the process performing extraction. The disclosure can be up to 32 KiB.

Q: Which versions should be reviewed?

libmspack versions through 0.11alpha are identified as affected. Review any deployment using those versions, particularly where untrusted CAB files may be extracted.

Published Oct 30, 2026

Updated

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.

Affected Software

4 affected components

debian/libmspack*

debian/libmspack<=0.11-1, <=0.11-1.1, <=0.11-2

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·02:16 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments that use libmspack to extract MS-ZIP CAB files from attacker-controlled or otherwise untrusted sources are exposed. The affected component is the MS-ZIP decompressor.

What does an attacker need to provide?

An attacker needs to supply a crafted MS-ZIP CAB file whose first block begins with a back-reference. No attacker privileges or user interaction are indicated in the supplied severity data.

What is disclosed if exploitation succeeds?

The extracted output can contain stale heap memory from the process performing extraction. The disclosure can be up to 32 KiB.

Which versions should be reviewed?

libmspack versions through 0.11alpha are identified as affected. Review any deployment using those versions, particularly where untrusted CAB files may be extracted.

CVE-2026-119602: libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to provide?

What is disclosed if exploitation succeeds?

Which versions should be reviewed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to provide?

What is disclosed if exploitation succeeds?

Which versions should be reviewed?