https://seclists.org/oss-sec/2026/q4/686: Fw: New cabextract 1.12 and libmspack 0.12alpha release

Published Nov 12, 2026

Updated

Affected Software

2 affected components

cabextract

libmspack

Frequently Asked Questions

Which releases include the reported fixes?

The fixes are included in cabextract 1.12 and libmspack 0.12alpha.

What kinds of attacker-controlled files can trigger the reported issues?

The reported cases involve crafted CAB and CHM files, including CAB files using LZX, MS-ZIP, or Quantum compression. Processing such files can trigger out-of-bounds writes, uninitialised-memory reads, buffer overreads or underreads, infinite loops, and hidden-entry behavior.

Is any issue tied to a non-default operating mode?

The use-after-free condition in cabd_can_merge_folders requires salvage mode to be enabled and a CAB set whose first mergeable file has an invalid filename. The supplied information does not state whether salvage mode is enabled by default.

https://seclists.org/oss-sec/2026/q4/686: Fw: New cabextract 1.12 and libmspack 0.12alpha release

Affected Software

Frequently Asked Questions

Which releases include the reported fixes?

What kinds of attacker-controlled files can trigger the reported issues?

Is any issue tied to a non-default operating mode?

Company

Resources

Contact

Frequently Asked Questions

Which releases include the reported fixes?

What kinds of attacker-controlled files can trigger the reported issues?

Is any issue tied to a non-default operating mode?