Skip to content
OpenAdvisories
Medium USN-8973-1 1 CVE

libmspack vulnerability

Published Nov 3, 2026 · Updated Nov 4, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libmspack did not properly initialize pointers
when handling errors while reading KWAJ archive headers. An attacker
could possibly use this issue to cause libmspack to crash, resulting
in a denial of service, or execute arbitrary code.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libmspack 0.10.1-2ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS libmspack 0.11-1.1ubuntu0.24.04.1
Ubuntu · 26.04 LTS 26.04:LTS libmspack 0.11-1.1ubuntu0.26.04.1
Ubuntu · 26.10 libmspack 0.11-1.1ubuntu0.26.10.1

Vulnerabilities 1

  • Medium 6.3
    CVE-2026-110602

    libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path

    libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to …

    kyz libmspack clamav clamav Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-110602