libmsiecf EUVD-2026-110491

Exploitation requires the victim to process an attacker-supplied MSIE cache index.dat file through a tool built on libmsiecf, and specifically requires the library's partial URL record recovery path (libmsiecf_url_values_read_data) to handle a recovered partial record whose unknown_offset is oversized. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) with required user/operator interaction (UI:P) - an analyst or automated pipeline must actually ingest the malicious file; there is no network-facing trigger and no privilege escalation or data disclosure (availability-only impact). Realistic exposure is therefore concentrated in forensic/DFIR workflows that parse untrusted or evidentiary index.dat files; environments that never process attacker-controlled cache files are effectively unaffected.

This is a genuine but low-urgency issue, not a high-severity emergency. The CVSS 4.0 base score is 6.8 (MEDIUM), and every signal points to a limited-impact denial of service rather than a broadly exploitable threat. The CVSS vector is local (AV:L) with passive user interaction required (UI:P) and impact confined to availability (VA:H; VC:N/VI:N) - there is no confidentiality or integrity impact, consistent with the CWE-415 double free that corrupts heap memory and crashes the process. EPSS is very low at 0.13% (2nd percentile), the CVE is NOT on the CISA KEV list, and there is no confirmed active exploitation, so the signals are internally consistent: a real bug with low real-world exploitation likelihood. Exploitation status: no public exploit identified at time of analysis as confirmed working code, however a public PoC reference exists (a hackmd technical write-up and a VulnCheck advisory) and it is not verified as working exploit code. The vulnerability was reported by VulnCheck and a vendor patch (commit a99a703) is available; the vuln.today decision label is 'this_month', indicating routine prioritization rather than act_now/emergency. One nuance worth flagging: the double free corrupts heap memory, which in theory can exceed a pure crash, but the available evidence describes only crashing of forensic tools, so impact should be treated as DoS unless further analysis proves otherwise.

An attacker crafts a malicious MSIE cache index.dat file whose recovered partial URL record contains an oversized unknown_offset, then gets it ingested by a victim running a forensic tool built on libmsiecf (e.g., as seized evidence or a submitted sample). When the tool performs partial record recovery via libmsiecf_url_values_read_data(), the double free corrupts heap memory and crashes the process. A public PoC reference exists (hackmd write-up / VulnCheck advisory) but is not verified as working exploit code; exploitation is local and requires the victim to process the attacker-supplied file (AV:L/UI:P).