CVE-2026-119602
Low · 3.7CVSS
3.7
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119375 SQLite before 3.54.0 contains an information disclosure vulnerability that allows… CWE-908
- CVE-2026-116739 VMime through 0.9.2 contains an information disclosure vulnerability in the… CWE-908
- CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. CWE-908
- CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an… CWE-908
- CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver… CWE-908
- CVE-2026-114501 Pillow is a Python imaging library. CWE-908
- CVE-2026-112897 Pillow is a Python imaging library. CWE-908
- CVE-2026-96206 Use of uninitialized resource in Windows Subsystem for Linux allows an authorized… CWE-908