libfwsi CVE-2026-111134

Exploitation requires a program that links or embeds libfwsi (e.g. plaso or other DFIR shell-item parsers) to process an attacker-controlled Windows artifact - specifically a .lnk file, jump list, or shell bag containing a crafted MTP file entry shell item of 10-73 bytes whose declared item data size is 44 or more. The limiting factors are substantial: the attack vector is local (the malicious file must be parsed by the victim's tooling), it needs passive user/operator interaction to load or analyze the file (UI:P), and the practical impact is a crash with at most limited adjacent-heap memory disclosure rather than code execution. It affects default parsing behavior of libfwsi through version 20260522 - no non-default configuration is required once a malicious shell item is processed.

This is a moderate-severity, low-priority issue for most environments despite a CVSS 4.0 base score of 6.9 (Medium). The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) shows the true nature of the flaw: it is a local, passive-user-interaction bug whose dominant impact is availability (VA:H, i.e. a crash) with only limited confidentiality exposure (VC:L) from reading adjacent heap memory, and no integrity impact. CWE-125 (out-of-bounds read) is consistent with this - it is a memory-safety read defect, not a code-execution or write primitive, so the 'Buffer Overflow' tag overstates it. No EPSS score was provided, there is no CISA KEV listing, and no explicit POC/exploit-code flag was supplied in the input, so there is no signal of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis'. A detailed third-party technical write-up (hackmd) and the exact vulnerable source lines are referenced, which lowers the barrier to reproduction but is not the same as weaponized exploit code. Net: real but low urgency - primarily a denial-of-service/robustness concern for forensic and shell-item-parsing tools that ingest untrusted .lnk files, jump lists, or shell bags, rather than a broadly exploitable remote threat.

An analyst or automated forensic pipeline ingests an attacker-supplied Windows artifact (a .lnk file, jump list, or shell bag) that embeds a crafted MTP file entry shell item declaring an item data size of 44+ bytes while the actual shell item is only 10-73 bytes. When libfwsi parses it in libfwsi_mtp_file_entry_values_read_data(), it reads past the heap buffer, crashing the consuming tool and potentially exposing small amounts of adjacent heap memory. A public technical write-up and the exact vulnerable source lines are referenced, easing reproduction, though no packaged exploit was indicated in the input.