mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
Off-by-one error in the READENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file.
The cabdreadstring function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
DISPUTED chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application.
Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.
The chmdinitdecomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.
The chmdreadheaders function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
Multiple integer overflows in the searchchunk function in chmd.c in libmspack before 0.5 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CAB archive.
Hi all,
Reporting a memory-safety issue found via independent source audit of libmspack (https://github.com/kyz/libmspack), a small C library for Microsoft compression formats (CAB, CHM, LIT, HLP, KWAJ, SZDD) used by cabextract and vendored by ClamAV (libclammspack), among others.
Summary: makedecodetable() in mspack/readhuff.h -- the shared Huffman decode-table builder used across the library's CAB/CHM/LZX decoders -- does not validate that its input code-length array satisfies Kraft's inequality before building extension nodes for long codes. A crafted, format-legal length distribution can cause it to write past the end of the caller-allocated decode table while still returning success, giving the caller no indication anything went wrong.
I've confirmed this is reachable through real library API calls with a hand-crafted input file, not just direct/synthetic function calls, and precisely measured the resulting out-of-bounds write. I'm holding back further technical detail (exact trigger conditions, PoC construction, affected call sites) pending coordinated disclosure.
Reported to the maintainer (Stuart Caie) directly by email on 2026-08-16. No CVE currently assigned. Requesting a CVE ID be reserved for tracking; full technical writeup and PoC will follow once a fix is available or a reasonable disclosure window has passed.
Happy to share full details privately with anyone who needs them for triage (distro security teams, downstream maintainers, etc.) -- just reach out directly.
Thanks, Sumit Chakraborty