libmspack EUVD-2026-101230

Requires that an application linked against libmspack (≤0.11alpha) invokes kwajd_open()/the KWAJ decompressor on attacker-supplied input, and that the attacker provides a malformed KWAJ file (truncated, zero-length, or wrong signature) that forces an early error return in kwajd_read_headers() before filename/extra are initialized. Limiting factors: exploitation is local/file-delivery and needs the application to actually process the file (UI:P) using the default mspack_system free(); the reliable outcome is a crash, and the arbitrary-free escalation is conditional on the uninitialized stack values (AT:P) being attacker-influenceable, which is not guaranteed across compilers/platforms. KWAJ is a less common format, so only code paths that invoke the KWAJ decompressor are affected.

This is a moderate, not top-priority, issue. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P, VC:N/VI:H/VA:H) describes a locally-reached, file-processing flaw that requires passive user/application interaction (feeding a crafted KWAJ file to a program linked against libmspack) and has no confidentiality impact. The score of 5.8 and CWE-824 (access of uninitialized pointer) align with the description: the primary, reliable outcome is a crash/DoS, while the 'arbitrary-free memory corruption primitive' is a potential-but-conditional escalation (reflected by AT:P - it depends on the uninitialized stack value being attacker-influenceable or non-NULL). Exploitation status: no public exploit identified as a weaponized tool, but reporter-supplied example trigger files (empty.kwj, blank.kwj) and a public technical write-up exist, so a crash PoC is effectively in the open - treat as 'publicly available exploit code exists.' KEV: not listed (no confirmed active exploitation). EPSS: not provided in the input, so real-world exploitation probability cannot be quantified - do NOT assume widespread exploitation. The signals are internally consistent (local vector + user interaction + DoS-leaning impact), so there is no conflict to flag, but note that libmspack is frequently embedded in antivirus/file scanners that auto-process untrusted input, which can raise effective exposure above a naive 'local' reading.

An attacker emails or uploads a truncated, empty, or wrong-signature KWAJ file to a service that uses libmspack (e.g., an antivirus scanner, cabextract, or archive handler). When the application calls kwajd_open() and the header read fails, kwajd_close() frees the uninitialized filename and extra pointers, crashing the process or corrupting memory. Reporter-supplied trigger files and a public write-up make reproduction trivial, though no weaponized code-execution exploit is confirmed.