CVE-2026-110602

MEDIUM 6.3

libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

CWE	CWE-824
Vendor	kyz
Product	libmspack
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for kyz libmspack

Be the first to know when new medium vulnerabilities affecting kyz libmspack are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

kyz / libmspack

0 ≤ 0.11alpha

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f github.com: https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181 hackmd.io: https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free vulncheck.com: https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path

Credits

HaiND from the Post and Telecommunication Institute of Technology