Description
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libyal | libmsiecf | ≤ 20260525 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmsiecf | No fix yet | — |
| Debian 13 | libmsiecf | No fix yet | — |
| Debian 12 | libmsiecf | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libmsiecf | No fix yet | — |
| Ubuntu 26.04 LTS | libmsiecf | No fix yet | — |
| Ubuntu 24.04 LTS | libmsiecf | No fix yet | — |
| Ubuntu 22.04 LTS | libmsiecf | No fix yet | — |
| Ubuntu 20.04 LTS | libmsiecf | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libmsiecf | No fix yet | — |
| Ubuntu 16.04 LTS | libmsiecf | No fix yet | — |
References
- GitHub Issue #6 issue-tracking
- https://github.com/libyal/libmsiecf product
- https://github.com/libyal/libmsiecf/commit/a99a703d190d62f6c21b6225cf84ce80037e45d5 patch
- https://github.com/libyal/libmsiecf/blob/20260525/libmsiecf/libmsiecf_url_values.c#L824 technical-description
- https://hackmd.io/@haindpwn/libmsiecf-url-record-partial-recovery-double-free third-party-advisory
- VulnCheck Advisory: libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data third-party-advisory