Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck
CVE-2026-116743libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
Medium 5.5
In plain English
A medium-severity double free in libmsiecf from libyal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 97.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmsiecf | no fix listed | DEBIAN-CVE-2026-116743 |
| Debian:13 | libmsiecf | no fix listed | DEBIAN-CVE-2026-116743 |
| Debian:14 | libmsiecf | no fix listed | DEBIAN-CVE-2026-116743 |
| Ubuntu:22.04:LTS | libmsiecf | no fix listed | UBUNTU-CVE-2026-116743 |
| Ubuntu:24.04:LTS | libmsiecf | no fix listed | UBUNTU-CVE-2026-116743 |
| Ubuntu:26.04:LTS | libmsiecf | no fix listed | UBUNTU-CVE-2026-116743 |
| Ubuntu:26.10 | libmsiecf | no fix listed | UBUNTU-CVE-2026-116743 |
Affected products (as reported)
Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Issue #6 issue-tracking
- https://github.com/libyal/libmsiecf product
- https://github.com/libyal/libmsiecf/commit/a99a703d190d62f6c21b6225cf84ce80037e45d5 patch
- https://github.com/libyal/libmsiecf/blob/20260525/libmsiecf/libmsiecf_url_values.c#L824 technical-description
- https://hackmd.io/@haindpwn/libmsiecf-url-record-partial-recovery-double-free third-party-advisory
- VulnCheck Advisory: libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data third-party-advisory