CVE-2026-110602
Medium
Description
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
SeverityMedium
CVSS6.3
Exploit probability—
ProductKyz Libmspack
PublishedOct 14, 2026
First seenOct 14, 2026
Weakness typeCWE-824CWE-824
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kyz libmspack | v ≤ 0.11alpha | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.