CVE-2026-119602 libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119602?
CVE-2026-119602 is a medium-severity vulnerability in kyz libmspack, published on 30 Oct 2026.
Official description
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
Weakness: CWE-908
Which versions are affected by CVE-2026-119602?
How do I fix CVE-2026-119602?
No fix has been published for CVE-2026-119602 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119602 being exploited?
There is no known exploitation of CVE-2026-119602 in the wild and no public exploit code.
Sources
Also known as AZL-112667, AZL-112676, DEBIAN-CVE-2026-119602, ECHO-5b67-4d2c-9768, GHSA-xxh6-gw5r-86fm, UBUNTU-CVE-2026-119602.