CVE-2026-111135 in libfwsi
Summary
by MITRE • 10/15/2026
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in libfwsi through version 20260522 represents a critical heap-based out-of-bounds read flaw located within the libfwsi_mtp_volume_values_read_data function. This library is responsible for parsing Windows Shell Item data, which includes structures used by various operating system components to manage file associations and shell extensions. The core technical defect arises from an insufficient validation of buffer boundaries when processing MTP (Media Transfer Protocol) volume values. Specifically, the function fails to adequately verify that the size of the item data does not exceed the allocated heap memory region before attempting to read it. This lack of rigorous bounds checking allows a crafted input to trigger a read operation that extends beyond the intended limits of the buffer, exposing adjacent memory contents or causing an access violation if the out-of-bounds address is unmapped.
The exploitation vector for this vulnerability involves embedding maliciously constructed shell items within files commonly processed by Windows Explorer and related system utilities. Attackers can craft specific payloads containing a shell item with a size ranging from 10 to 53 bytes, where the embedded item data size is set to 44 bytes or more. These crafted structures are designed to be placed inside .lnk shortcut files, Jump Lists, or Shell Bags. When a user interacts with these files—such as opening them in Windows Explorer, viewing their properties, or having the system index them—the libfwsi library processes the shell item data. The flawed logic within libfwsi_mtp_volume_values_read_data then attempts to read past the allocated buffer boundary based on the manipulated size fields provided by the attacker.
The operational impact of this vulnerability is primarily characterized by application instability and potential denial of service conditions. As noted in the initial reports, triggering this flaw typically results in a crash of the consuming process, such as explorer.exe or other applications that utilize libfwsi for shell item parsing. While heap out-of-bounds reads can theoretically lead to information disclosure if the attacker can control the read outcome and observe side effects, the immediate and most consistent impact observed is system instability due to memory access violations. In enterprise environments where users frequently interact with untrusted files or navigate network shares containing malicious shortcuts, this vulnerability poses a significant risk of service disruption. It undermines the reliability of file management operations and can be leveraged in social engineering attacks to disrupt workflow by causing frequent application crashes upon user interaction.
From a classification perspective, this flaw aligns with CWE-125, which denotes Out-of-bounds Read vulnerabilities where software reads past the end of an allocated buffer. It also relates to CWE-20, Improper Input Validation, as the root cause is the failure to properly validate the size parameters provided by external inputs before performing memory operations. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques associated with Initial Access and Execution via user interaction, specifically leveraging malicious files such as LNK shortcuts or Jump Lists to trigger code execution paths within system libraries. The attack pattern relies on the victim's trust in file associations and automatic parsing mechanisms inherent to modern operating systems.
Mitigation strategies for this vulnerability focus primarily on software updates and defensive configuration practices. Users and administrators should immediately update libfwsi to a version released after 20260522, where the developers have presumably implemented proper bounds checking within the libfwsi_mtp_volume_values_read_data function. Until patches are applied in all environments, organizations can mitigate risk by restricting user permissions on directories containing untrusted files and disabling automatic execution of shell items or Jump Lists where possible. Security awareness training should also emphasize caution when opening shortcut files from unknown sources. Furthermore, deploying endpoint detection and response solutions that monitor for abnormal memory access patterns or crashes in explorer.exe may help identify attempted exploitation activities in real-time, providing an additional layer of defense against this specific heap corruption technique.