CVE-2026-116743
libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
libyal libmsiecf
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
Text from CVE List
Affected versions 1
- libmsiecfaffected: all versions through 20260525CVE List
References 6
- github.com/libyal/libmsiecf/commit/a99a703d190d62f6c21b6225cf84ce80037e45d5Fixvia CVE List
- hackmd.io/@haindpwn/libmsiecf-url-record-partial-recovery-double-freeAdvisoryvia CVE List
- vulncheck.com/advisories/libyal-libmsiecf-through-20260525-double-free-via-libmsiecf-url-values-read-dataAdvisoryvia CVE List
- github.com/libyal/libmsiecf/issues/6Referencevia CVE List
- github.com/libyal/libmsiecfReferencevia CVE List
- github.com/libyal/libmsiecf/blob/20260525/libmsiecf/libmsiecf_url_values.c#L824Referencevia CVE List