{"id":"CVE-2026-111134","summary":"libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data","details":"libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.","modified":"2026-10-17T07:06:56.252383833Z","published":"2026-10-15T18:57:28.492Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111134.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111134.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111134"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libfwsi-through-20260522-heap-out-of-bounds-read-via-libfwsi-mtp-file-entry-values-read-data"},{"type":"PACKAGE","url":"https://github.com/libyal/libfwsi"},{"type":"ARTICLE","url":"https://github.com/libyal/libfwsi/blob/2f2aba25b888f37314a39d8c3e71c0e3ced56e59/libfwsi/libfwsi_mtp_file_entry_values.c#L245-L267"},{"type":"ARTICLE","url":"https://hackmd.io/@haind-pwn/libfwsi-mtp-values-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libyal/libfwsi","events":[{"introduced":"0"},{"fixed":"2f2aba25b888f37314a39d8c3e71c0e3ced56e59"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"20260522"},{"fixed":"20260522"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["20240423"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111134.json","vanir_signatures":[{"id":"CVE-2026-111134-9b5bf35e","signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libfwsi/commit/2f2aba25b888f37314a39d8c3e71c0e3ced56e59","target":{"file":"libfwsi/libfwsi_file_entry_extension_values.c","function":"libfwsi_file_entry_extension_values_read_data"},"deprecated":false,"digest":{"length":8332,"function_hash":"52249065870070756351280488421904560654"}},{"id":"CVE-2026-111134-b982fa06","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libfwsi/commit/2f2aba25b888f37314a39d8c3e71c0e3ced56e59","target":{"file":"libfwsi/libfwsi_extension_block.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224651923280854872885516230255804997003","138044201423073413648662197725998702053","303901833413917299164584522051619786481","113706438340019495583844208215022298728"]}},{"digest":{"function_hash":"75918460641425831195352662038878316570","length":12486},"id":"CVE-2026-111134-e9a73371","signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libfwsi/commit/2f2aba25b888f37314a39d8c3e71c0e3ced56e59","target":{"function":"libfwsi_extension_block_copy_from_byte_stream","file":"libfwsi/libfwsi_extension_block.c"},"deprecated":false},{"digest":{"line_hashes":["67930153711839799310707051520779057619","144535581873453472409010826012663438322","312603109391185089924779811944551989877","195331882319961826883412432496109071174","109189158880703298684989733874155245848","110841016066259506891085418717905738431","149747514090452068230101175727873020272","121922155244344388986120668356893367129","20005130046623946654157927046117803275","331322047195423312570075233818593246767","323155804905243365690988334304851992661","19717008504332275863266611103015480972","98013361167702627980277889550128390477","318319483156471098845439619033914526048","272081606659828412915787503107152455036","155474184740034820551535546300404327737","57827673961664181273466088804922062668","94293689901534391359798147313293866165","340048040237421448013918863536931424711","111292176753692359111283158545850583440","266381468624427652461643560234794592266","214562726594813233911286455988398845481","118166422977923823912111593286155441024","275344959452422577311471480744015967556","70557681730605615660530955200410005819","29059521244825577950751402798708180889","213571120656495593096052507212079111847","201629094624428267353020639291825428372","4901207974491912796036460761155996227","8867301039427550689768336823766220488","304210124691861791595579402695328526499","167767602378075999608719546876585146150","90695386647878112497312099324139001452","113064447657547573499974671429567918638","197373956005419432095372036484673558712","109775490943245643568791047574678955067","306806853799203268561658172162947787749","274110988979962712190391911659587747651","157484887421535382339900397209411973395","13549242561391956493104161928022921534","257197392433439267880861652877845947387","138922149205497560726565870616448478699","14278425819420313824707933800311647270","140587501698079465666679097840053308092","54361180973445474366340730510727686465","66662222737258779543301372841717450354","58779236293618469432099272647076301397","119347440814988047014190873832431721335","202697744123315880155518817919734455722","211255843782736226078018794523394882086","219556066129991301355167909114345000213","227086416904053851964886589851920289711","303358368176258819349631045698881469905","21458921733122433174362660251074407210","37582403826565813185193706999991960478","93864414346974774665108240799291359282","16893839223331968007659739851904221230","100324254394987758755962603635465327486","307599497107643233795132457179497610406","235215974685738794462555127672802931245","107702347051444583305831002901297472530","133141369853707807606279781974818532873","236220499995625778456660840089919885465","219519113532336254584590834139929357653","320810201409509554170332470778500421993","209965524373085052041446966346449134310","175512672663247692356839608616947412008","158595647688225982249689330232627517042","25295824466517007878398222847043974579","318492572088497917814346192660705435415","53219064560413012422006633236357273713","136202307018333866404034256953204760324","200449514623708149699659001329408264768","115039975344088600104026940554398210359","192532353049248950229820475784181634598","314142792476480643571302257278547347445","131867810067106976715446540720260675225","172159591983757849141698751241290730413","137080238563376728158479616797640986410","14318449087962918055754753960161412850","172803966188365988548051056884856610360","112687261784294654506062180342885176189","9724803200681349053543328162743913657","62579005012191215434252676734464977069","331442678491539592731174669534517494336","84921617908382756159430688643968434440","104269895847477934143794263385041611521","84704024894536300055344510547425536454","284076497153493078693867826359653573004","19217513613549529443829261215420360073","104960016225905273410691153983207685547","204463116551514526887055130199097045821","334670479457580845790245922360368515821","49092142101373017831721950717596073698","172887230715165826832588988322561906025","9724803200681349053543328162743913657","70586320234754575881004643431511739309","305088230905949438058399232382011470745","283700396821704484825634826611868551711","47162228328936860762346214806731257345","36962468485714180919669949004994713956","291333525837882545266251063945034732432","62423086099207373682365824211440012668","295840489422949839064825851133887686470","7759121338991181334574968565321404475","213082304228564941755110550632005620050","86179372723492998157901929107006533675","199100057412620141371782958050980292442","6370550737637661326130725275227358606","279710325370743615868112693704599797174","25077026364926500752334747349938683279","33947486271694447827451892330180395286","38834029841348825304534629666441366657","90878425398801556936846247112417289070","30819773851290529809336753182571839575","53219064560413012422006633236357273713","194472210389187499375728284768509379727","258398658395393715111665920518585360212","246780866128976893501253027033165822381","118751426926662951648190719778670234342","190043965889444382867969642688048683944","193110813271088907966443868560113797501","275052740906238376077017491750552337838","264315858587120560162847420357942144000","261191707640414164791235047728835499135","258053941151973001175041871708214995285","230018335020821921145161562439741347543","202047744081254779157531625361538473731"],"threshold":0.9},"id":"CVE-2026-111134-ec61e0c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libfwsi/commit/2f2aba25b888f37314a39d8c3e71c0e3ced56e59","target":{"file":"libfwsi/libfwsi_file_entry_extension_values.c"},"deprecated":false}],"vanir_signatures_modified":"2026-10-17T07:06:56Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}