Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-119602

libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kyzer Libmspack Project
Products
Libmspack Libmspack
CVE-2019-1010305

libmspack: buffer overflow in function chmd_read_headers()

libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2018-18586

libmspack: Directory traversal in chmextract.c

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

CVSS 3.0 · 5.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Kyzer
Products
Libmspack
CVE-2018-18585

libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Kyzer and 3 more
Products
Ubuntu Linux Debian Linux Libmspack and 6 more