{"id":"CVE-2026-119602","title":"libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window","summary":"libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB fi…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-908"],"vendor":"kyz","product":"libmspack","affected":["libmspack <= 0.11alpha"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:21:16.087677Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:53:29.159Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119602","references":[{"url":"https://github.com/kyz/libmspack/issues/60"},{"url":"https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/mszipd.c#L264-L276"},{"url":"https://hackmd.io/@haindpwn/libmspack-mszip-uninit-window-info-leak"},{"url":"https://github.com/kyz/libmspack"},{"url":"https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-memory-disclosure-via-ms-zip-decompressor-window","label":"VulnCheck Advisory: libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window"}],"tags":["cve.org"],"epss":0.00307,"epssPercentile":0.23632,"ingestedAt":"2026-11-05T16:07:30.515Z","slug":"CVE-2026-119602","body":"## Overview\n\nlibmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.\n\n## Affected\n\n- `libmspack <= 0.11alpha`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}