Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-111134 →

DEBIAN-CVE-2026-111134

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read p...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 libfwsi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libfwsi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libfwsi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

advisory security-tracker.debian.org