Read the docs
TI-2026-74918 Aliases CVE-2026-111134

Heap out-of-bounds read in libfwsi MTP file entry parsing

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libfwsi through 20260522 contains a heap out-of-bounds read in libfwsi_mtp_file_entry_values_read_data() that lets attackers read past buffer bounds. Attackers can craft MTP file entry shell items in .lnk files, jump lists or shell bags to make libfwsi consumers crash. A local attacker who can get a user to open a crafted file can trigger the flaw, and no user privileges are needed. CISA's SSVC data records proof-of-concept exploitation, but the flaw is not in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libyallibfwsiup to 20260522—No fix listedCNA
  • libfwsi Vendorlibyal Affected up to 20260522 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libfwsi.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111134
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-26 CISA SSVC decision points changed
  4. 2026-10-26 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
  • TI-2026-80944 Heap out-of-bounds read in libpff table record parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74943 Heap out-of-bounds read in libewf L01 extended attribute parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74931 Heap out-of-bounds read in libyal libesedb multi-value handling CVSS 4.0MEDIUM 6.9
  • TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74919 libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data CVSS 4.0MEDIUM 6.9
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences