CVE-2026-119602
libmspack: libmspack: Information disclosure via unchecked back-references in MS-ZIP decompressor
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 30, 2026
Updated · November 2, 2026
Description
A flaw was found in libmspack. The MS-ZIP decompressor fails to properly validate back-reference distances when decompressing cabinet (CAB) archive files. By providing a specially crafted archive whose initial block starts with a back-reference, an attacker can cause the extraction routine to copy uninitialized heap memory into the extracted file. This flaw leads to information disclosure, potentially exposing sensitive data stored in memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-908 · Use of Uninitialized Resource