CVE-2026-110602

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110602", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-14T13:07:20.909Z", "datePublished": "2026-10-14T14:16:43.661Z", "dateUpdated": "2026-10-14T18:01:09.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T14:16:43.661Z"}, "datePublic": "2026-10-14T00:00:00.000Z", "title": "libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path", "descriptions": [{"lang": "en", "value": "libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Access of Uninitialized Pointer", "cweId": "CWE-824", "type": "CWE"}]}], "affected": [{"vendor": "kyz", "product": "libmspack", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "0.11alpha", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/kyz/libmspack", "collectionURL": "https://github.com", "repo": "https://github.com/kyz/libmspack"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:libmspack_project:libmspack:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.11alpha"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f", "tags": ["patch"]}, {"url": "https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-14T17:59:54.674497Z", "id": "CVE-2026-110602", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T18:01:09.032Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110602", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T17:59:54.674497Z"}}}], "references": [{"url": "https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T18:01:04.538Z"}}], "cna": {"title": "libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/kyz/libmspack", "vendor": "kyz", "product": "libmspack", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.11alpha"}], "packageURL": "pkg:github/kyz/libmspack", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}], "datePublic": "2026-10-14T00:00:00.000Z", "references": [{"url": "https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f", "tags": ["patch"]}, {"url": "https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path", "name": "VulnCheck Advisory: libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-824", "description": "Access of Uninitialized Pointer"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libmspack_project:libmspack:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.11alpha"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T14:16:43.661Z"}}}, "cveMetadata": {"cveId": "CVE-2026-110602", "state": "PUBLISHED", "dateUpdated": "2026-10-14T18:01:09.032Z", "dateReserved": "2026-10-14T13:07:20.909Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-14T14:16:43.661Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "defaultStatus": "unaffected", "packageURL": "pkg:github/kyz/libmspack", "product": "libmspack", "repo": "https://github.com/kyz/libmspack", "vendor": "kyz", "versions": [{"lessThanOrEqual": "0.11alpha", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive."}], "id": "CVE-2026-110602", "lastModified": "2026-10-16T19:18:44.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110602", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-14T17:59:54.674497Z", "version": "2.0.3"}}]}, "published": "2026-10-14T15:17:11.677", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-824"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libmspack: libmspack: Memory corruption via uninitialized pointer free in kwajd_open", "id": "2552272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552272"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["A flaw was found in libmspack. An attacker could exploit this vulnerability by enticing a user or application to process a specially crafted KWAJ compressed file containing invalid or truncated headers. When handling these errors, the library attempts to release uninitialized memory pointers, potentially leading to memory corruption or an application crash that results in a Denial of Service (DoS)."], "name": "CVE-2026-110602", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libmspack", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libmspack", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libmspack", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libmspack", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T14:16:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110602\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110602\nhttps://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181\nhttps://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f\nhttps://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free\nhttps://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path"], "threat_severity": "Moderate"}

{"created": "2026-10-15T03:15:13.211295+00:00", "updated": "2026-10-15T21:45:17.801130+00:00", "vendors": []}