---
id: CVE-2026-110602
title: >-
  libmspack through 0.11alpha contains an uninitialized pointer free
  vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename
  and extra pointers on header read errors
summary: >-
  libmspack through 0.11alpha contains an uninitialized pointer free
  vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename
  and extra pointers on header read errors. Attackers can supply a truncated,
  empty, or wrong-s…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H'
cwe:
  - CWE-824
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:17:34.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110602'
references:
  - url: >-
      https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/kwajd.c#L111-L181
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-pointer-free-via-kwajd-open-error-path
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.002Z'
---

## Overview

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.