Double Free Vulnerability in libmsiecf Affects libyal Products
CVE-2026-116743

6.8MEDIUM

Key Information:

Vendor

Libyal

Status
LIBMsiecf
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116743?

The libmsiecf library, maintained by libyal, has a significant vulnerability that occurs in the function libmsiecf_url_values_read_data(). This vulnerability presents a double free condition, allowing attackers to manipulate heap memory. By supplying a specially crafted MSIE cache index.dat file, which includes a malformed record with an oversized unknown_offset value, attackers can crash forensic tools utilizing this library. This could lead to service disruptions and potential exploitation in applications relying on libmsiecf for URL record processing.

Affected Version(s)

libmsiecf 0 <= 20260525

References

https://github.com/libyal/libmsiecf/issues/6
issue-tracking
https://github.com/libyal/libmsiecf
product
https://github.com/libyal/libmsiecf/commit/a99a703d190d62...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.