Bug 2558186

Summary:	CVE-2026-110602 libmspack: libmspack: Memory corruption via uninitialized pointer free in kwajd_open [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Ganesh <gnaik>
Component:	libmspack	Assignee:	Dan Horák <dan>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	dan, orion
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["ad4491a3-49f0-44d8-bca5-33fe7563e8fe"]}
Fixed In Version:	libmspack-0.11-0.1.alpha.fc46	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-21 12:49:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2552272

Description Ganesh 2026-10-21 10:18:52 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

Comment 1 Fedora Update System 2026-10-21 11:52:17 UTC

FEDORA-2026-ed3c0a9bce (libmspack-0.11-0.1.alpha.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-ed3c0a9bce

Comment 2 Fedora Update System 2026-10-21 12:49:13 UTC

FEDORA-2026-ed3c0a9bce (libmspack-0.11-0.1.alpha.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 3 Orion Poplawski 2026-10-22 01:54:37 UTC

From what I can see, this was fixed in commit 4d868504114346aa767d435fbb89a8b76603493f which is not in any released version -

Comment 4 Dan Horák 2026-10-22 06:22:22 UTC

Correct, that why the mentioned commit is applied on top of the 0.11alpha.

Comment 5 Orion Poplawski 2026-10-24 21:18:24 UTC

Ah, indeed.  Sorry for missing that.