libfwsi CVE-2026-111135

Exploitation requires that a process or tool using the libyal libfwsi library parse an attacker-supplied Windows shell-item artifact - specifically a .lnk file, a jump list, or a shell bag - that embeds a crafted MTP volume shell item of 10 to 53 bytes declaring an item data size of 44 bytes or more, which triggers the out-of-bounds read in libfwsi_mtp_volume_values_read_data(). Limiting factors: the vector is local (AV:L), the victim must actively process the malicious file (UI:P), no attacker privileges are needed (PR:N), and the realistic impact is a crash of the consuming process rather than code execution. Practical reach is further constrained to environments that actually deploy libfwsi-based parsers, such as digital-forensics/timeline tooling.

This is a medium-severity (CVSS 4.0 base 6.9), locally-reachable out-of-bounds read (CWE-125) in the libyal libfwsi shell-item parsing library. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) is internally consistent with the description: the attack vector is local because the attacker must supply a crafted artifact (a .lnk file, jump list, or shell bag) that a victim process parses, and UI:P reflects that passive user/tool interaction (opening or processing the file) is required. The dominant impact is availability (VA:H - crashing the consuming process via the OOB read), with only low confidentiality impact (VC:L) from potentially reading adjacent heap memory; there is no integrity or code-execution impact claimed. No EPSS score, CISA KEV listing, or explicit POC flag was supplied in the input, so exploitation-probability and active-exploitation signals cannot be quantified - however, a detailed public technical write-up (hackmd) and a VulnCheck advisory exist, indicating the defect and its trigger conditions are publicly documented. Weighing the signals: despite a non-trivial CVSS score, real-world priority is modest because the flaw is local-vector, requires feeding a crafted file to a victim that uses this specific forensic library, and primarily yields a denial-of-service (crash) rather than code execution. There is no conflict between the signals; the main caveat is the absence of EPSS/KEV data, so exploitation likelihood is unquantified rather than confirmed low.

An attacker crafts a malicious .lnk file, Windows jump list, or shell bag embedding a malformed MTP volume shell item (10-53 bytes with a declared item data size of 44 or more) and delivers it to a victim whose tooling parses shell items with libfwsi - for example a DFIR analyst ingesting attacker-controlled evidence or an application processing a user-supplied shortcut. When the library reaches libfwsi_mtp_volume_values_read_data(), it reads past the heap buffer, crashing the consuming process (and possibly leaking small amounts of adjacent memory). A public technical write-up documents the trigger, but no confirmed weaponized exploit code is indicated in the provided data.