CVE-2026-110602EPSS p13.5%

CVE-2026-110602CVE-2026-110602

Description

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

Scoring

CVSS 6.3 ()
VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
EPSS0.24% probability of exploitation · percentile 13.5% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.