Description
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libyal libfwsi
Default version status: unaffected
0 to ≤ 20260522affected
pkg:github/libyal/libfwsiReferences
- https://hackmd.io/@haind-pwn/libfwsi-mtp-values-oob-read ↗
- https://github.com/libyal/libfwsi/blob/2f2aba25b888f37314a39d8c3e71c0e3ced56e59/libfwsi/libfwsi_mtp_volume_values.c#L248-L273 ↗
- https://github.com/libyal/libfwsi ↗
- https://www.vulncheck.com/advisories/libfwsi-through-20260522-heap-out-of-bounds-read-via-libfwsi-mtp-volume-values-read-data ↗
- https://hackmd.io/@haind-pwn/cve-2026-111134-111135-libfwsi-mtp-values-oob-read ↗