CVE-2026-111134
libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data
libyal libfwsi
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.
Text from CVE List
Affected versions 1
- libfwsiaffected: all versions through 20260522CVE List
References 4
- vulncheck.com/advisories/libfwsi-through-20260522-heap-out-of-bounds-read-via-libfwsi-mtp-file-entry-values-read-dataAdvisoryvia CVE List
- hackmd.io/@haind-pwn/libfwsi-mtp-values-oob-readReferencevia CVE List
- github.com/libyal/libfwsi/blob/2f2aba25b888f37314a39d8c3e71c0e3ced56e59/libfwsi/libfwsi_mtp_file_entry_values.c#L245-L267Referencevia CVE List
- github.com/libyal/libfwsiReferencevia CVE List