CVE-2026-116743
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Oct 26, 2026
CISA due date
—
The record
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119338 Tesseract is an open source OCR engine. CWE-415
- CVE-2026-119116 A use-after-free and double-free issue in the SetClient command handler of the… CWE-415
- CVE-2026-85890 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute… CWE-415
- CVE-2026-83831 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute… CWE-415
- CVE-2026-88812 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before… CWE-415
- CVE-2026-112457 A double free issue was addressed with improved memory management. CWE-415
- CVE-2026-78116 The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission… CWE-415
- CVE-2026-94300 Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". CWE-415