Read the docs
TI-2026-74096 Aliases CVE-2026-110602GHSA-5m37-fqj8-q94j

Uninitialized pointer free in libmspack KWAJ header handling

Priority MEDIUM 59CWE-824Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Libmspack versions from 0 through 0.11alpha are affected. The kwajd_open function in mspack/kwajd.c frees uninitialized filename and extra pointers when header reads fail, which is classified as CWE-824. If a user opens a truncated, empty, or wrong-signature KWAJ file, an attacker can crash the process or obtain an arbitrary-free memory corruption primitive.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kyzlibmspackup to 0.11alpha—No fix listedCNA
  • libmspack Vendorkyz Affected up to 0.11alpha Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libmspack. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat OpenShift Container Platform 4 and 5 as affected with no update available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110602
  2. 2026-10-14 Alias added: GHSA-5m37-fqj8-q94j
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-16 CVSS score added · Red Hat
  6. 2026-11-05 Affected versions changed · Red Hat

References

Patch 1

Advisory 1

Other 1

  • TI-2026-83087 Uninitialized memory disclosure in libmspack MS-ZIP decompressor CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences