UBUNTU-CVE-2026-110602: Medium severity ubuntu/clamav vulnerability

Q: What attacker access and interaction are required?

The vector is local and requires user interaction, but no privileges are required. An attacker must cause a target process to handle a malformed KWAJ file.

Q: Which Ubuntu packages should be prioritized for triage?

The affected software list includes ubuntu/libmspack and ubuntu/clamav. Systems using either package should be reviewed for KWAJ file processing exposure.

Q: Can patched status be determined from the supplied version information?

The record states that upstream libmspack is affected through 0.11alpha, but it does not provide Ubuntu package fix versions. The supplied data alone cannot confirm whether a particular Ubuntu package build is patched.

Published Oct 14, 2026

Updated

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

Affected Software

9 affected componentsFixes available

ubuntu/clamav*

ubuntu/libmspack*

ubuntu/libmspack<0.10.1-2ubuntu0.1

0.10.1-2ubuntu0.1

ubuntu/libmspack<0.11-1.1ubuntu0.24.04.1

0.11-1.1ubuntu0.24.04.1

ubuntu/libmspack<0.11-1.1ubuntu0.26.10.1

0.11-1.1ubuntu0.26.10.1

ubuntu/libmspack<0.11-1.1ubuntu0.26.04.1

0.11-1.1ubuntu0.26.04.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libmspack to a version that resolves this vulnerability.
Fixed in 0.10.1-2ubuntu0.1
Upgrade
Upgrade ubuntu/libmspack to a version that resolves this vulnerability.
Fixed in 0.11-1.1ubuntu0.24.04.1
Upgrade
Upgrade ubuntu/libmspack to a version that resolves this vulnerability.
Fixed in 0.11-1.1ubuntu0.26.10.1
Upgrade
Upgrade ubuntu/libmspack to a version that resolves this vulnerability.
Fixed in 0.11-1.1ubuntu0.26.04.1

Event History

Oct 14, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What attacker access and interaction are required?

The vector is local and requires user interaction, but no privileges are required. An attacker must cause a target process to handle a malformed KWAJ file.

Which Ubuntu packages should be prioritized for triage?

The affected software list includes ubuntu/libmspack and ubuntu/clamav. Systems using either package should be reviewed for KWAJ file processing exposure.

Can patched status be determined from the supplied version information?

The record states that upstream libmspack is affected through 0.11alpha, but it does not provide Ubuntu package fix versions. The supplied data alone cannot confirm whether a particular Ubuntu package build is patched.

UBUNTU-CVE-2026-110602: Medium severity ubuntu/clamav vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What attacker access and interaction are required?

Which Ubuntu packages should be prioritized for triage?

Can patched status be determined from the supplied version information?

Company

Resources

Contact

Frequently Asked Questions

What attacker access and interaction are required?

Which Ubuntu packages should be prioritized for triage?

Can patched status be determined from the supplied version information?