CVE-2026-116743: falha de média gravidade em libyal libmsiecf
libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.1%
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
libyal · libmsiecfReferências
https://github.com/libyal/libmsiecfhttps://github.com/libyal/libmsiecf/blob/20260525/libmsiecf/libmsiecf_url_values.c#L824https://github.com/libyal/libmsiecf/commit/a99a703d190d62f6c21b6225cf84ce80037e45d5https://github.com/libyal/libmsiecf/issues/6https://hackmd.io/@haindpwn/libmsiecf-url-record-partial-recovery-double-freehttps://www.vulncheck.com/advisories/libyal-libmsiecf-through-20260525-double-free-via-libmsiecf-url-values-read-data