Read the docs
TI-2026-74919 Aliases CVE-2026-111135GHSA-7h63-p8xp-f7mw

libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libfwsi through 20260522 contains a heap out-of-bounds read in libfwsi_mtp_volume_values_read_data() (CWE-125). A crafted MTP volume shell item embedded in a .lnk file, jump list or shell bag lets an attacker read past buffer bounds and crash the consuming process. The CVSS 4.0 vector indicates local attack requiring user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libyallibfwsiup to 20260522—No fix listedCNA
  • libfwsi Vendorlibyal Affected up to 20260522 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libfwsi.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111135
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-21 Alias added: GHSA-7h63-p8xp-f7mw
  4. 2026-10-21 CISA SSVC decision points changed
  5. 2026-10-21 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
  • TI-2026-80944 Heap out-of-bounds read in libpff table record parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74943 Heap out-of-bounds read in libewf L01 extended attribute parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74931 Heap out-of-bounds read in libyal libesedb multi-value handling CVSS 4.0MEDIUM 6.9
  • TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74918 Heap out-of-bounds read in libfwsi MTP file entry parsing CVSS 4.0MEDIUM 6.9
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences