Description
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libyal libfwsi
Default version status: unaffected
0 to ≤ 20260522affected
pkg:github/libyal/libfwsiReferences
- https://hackmd.io/@haind-pwn/libfwsi-mtp-values-oob-read ↗
- https://github.com/libyal/libfwsi/blob/2f2aba25b888f37314a39d8c3e71c0e3ced56e59/libfwsi/libfwsi_mtp_file_entry_values.c#L245-L267 ↗
- https://github.com/libyal/libfwsi ↗
- https://www.vulncheck.com/advisories/libfwsi-through-20260522-heap-out-of-bounds-read-via-libfwsi-mtp-file-entry-values-read-data ↗