CVE-2026-110602 in libmspack
Summary
by MITRE • 10/14/2026
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in libmspack versions up through 0.11alpha represents a critical flaw within the kwajd_open function located in the mspack/kwajd.c source file. This specific issue is classified as an uninitialized pointer free, which falls under the Common Weakness Enumeration category CWE-457. The root cause of this defect lies in how the library handles error conditions during the parsing and validation of KWAJ archive headers. When a user supplies a malformed input file—specifically one that is truncated, empty, or possesses an incorrect signature—the internal logic fails to properly initialize certain pointer variables before attempting to clean up resources upon detecting the header read failure.
In normal operation, when a library processes an archive format like KWAJ, it allocates memory for various metadata structures including filenames and extra data fields. If the parsing process encounters an error early in the sequence, such as failing to validate the file signature or encountering unexpected end-of-file conditions, the application is expected to release any allocated resources before returning control to the caller. However, due to this implementation oversight, the pointers associated with filename and extra data remain unzeroed even though they were never successfully populated with valid memory addresses during a failed read operation. Consequently, when the cleanup routine executes, it attempts to deallocate these uninitialized or garbage pointer values using standard free functions.
The operational impact of this vulnerability is severe because it provides attackers with an arbitrary-free memory corruption primitive. By crafting specific malicious KWAJ files that trigger the header read error path, a remote attacker can force the application to execute a free operation on invalid memory addresses. This behavior typically results in immediate process crashes, leading to denial-of-service conditions for any service or user relying on libmspack to handle these archives. More critically, if the underlying heap allocator and surrounding memory layout allow it, manipulating uninitialized pointers during deallocation can lead to more sophisticated exploitation scenarios. Arbitrary-free primitives are often leveraged by attackers to achieve arbitrary code execution through techniques such as heap overflow manipulation or overwriting function pointers in adjacent data structures.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1496, Resource Hijacking, specifically regarding denial of service via resource exhaustion if the crash is exploited repeatedly, although its primary exploitability lies in memory corruption which may facilitate further lateral movement or privilege escalation depending on the context of the application using libmspack. The lack of proper initialization and validation before cleanup violates fundamental secure coding principles outlined in standards such as CWE-457 for use of uninitialized variables and CWE-416 for use after free, although here it is specifically a double-free-like scenario involving invalid pointers rather than strictly freed memory.
To mitigate this vulnerability, developers integrating libmspack should ensure they are using patched versions that address the initialization logic within kwajd_open. For organizations unable to immediately upgrade, implementing strict input validation at the application layer before passing files to the library can reduce exposure. This includes verifying file signatures and sizes against expected parameters prior to invoking parsing functions. Additionally, enabling robust crash reporting mechanisms such as Address Sanitizer during development and testing phases helps in identifying similar uninitialized pointer issues across other modules within the codebase. Regular security audits focusing on error handling paths are essential to prevent these types of resource management flaws from persisting in production environments.