This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-111134 →

DEBIAN-CVE-2026-111134

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read p...

Original description

The description as published by the source.

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libfwsi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libfwsi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libfwsi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org