Hi,

The following vulnerability was published for libmspack.

CVE-2026-110602[0]:
| libmspack through 0.11alpha contains an uninitialized pointer free
| vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed
| filename and extra pointers on header read errors. Attackers can
| supply a truncated, empty, or wrong-signature KWAJ file to crash the
| process or obtain an arbitrary-free memory corruption primitive.

https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110602
https://www.cve.org/CVERecord?id=CVE-2026-110602

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
libmspack, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151083@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marc Dequènes (Duck) <Duck@DuckCorp.org> (supplier of updated libmspack package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 21 Oct 2026 03:16:20 +0900
Source: libmspack
Architecture: source
Version: 0.11-2
Distribution: unstable
Urgency: medium
Maintainer: Marc Dequènes (Duck) <Duck@DuckCorp.org>
Changed-By: Marc Dequènes (Duck) <Duck@DuckCorp.org>
Closes: 1151083
Changes:
 libmspack (0.11-2) unstable; urgency=medium
 .
   * Apply patch to fix security issue CVE-2026-110602 (Closes:
     #1151083).
   * Bump Standards-Version to 4.7.4 (no changes).
   * Switch watch file to version 5.
   * Switch to Debhelper compat 14.
Checksums-Sha1:
 9de6e841fb2fa7aba736076d8199a07e11b5f191 2029 libmspack_0.11-2.dsc
 a3712a07d2ca80c9f325494cd8a52d7c471d14e6 4864 libmspack_0.11-2.debian.tar.xz
 eb12abb6a0d35999b9d1116d7f17de06debaef69 8448 libmspack_0.11-2_amd64.buildinfo
Checksums-Sha256:
 d373e94b9b7940b2510a4d84b176c6c7ecef89f65e50038cc9b4bfdf2458b377 2029 libmspack_0.11-2.dsc
 e0e952ec9d14c32d3ccca0b2eb941c66ec46cacf43d1822360fd273cd9016fb3 4864 libmspack_0.11-2.debian.tar.xz
 417b7699616f7a3fc6c4ec7467c0c58d24d4d605c5298adf03ed8769c81bf93c 8448 libmspack_0.11-2_amd64.buildinfo
Files:
 563339e721c78a45dbc09f04f56cc013 2029 libs optional libmspack_0.11-2.dsc
 b31fd4e64cc53537dedd73cf4143d78d 4864 libs optional libmspack_0.11-2.debian.tar.xz
 70e2b2f0385ff28b0ef49c9b755068a6 8448 libs optional libmspack_0.11-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEcpcqg+UmRT3yiF+BVen596wcRD8FAmrXsf0ACgkQVen596wc
RD84hw//cGcoiMedSCh7suC+64c2Gu6gBBopuwSFW2VOv/ko5weTgYEMWnTK1nTw
eFcyJaMf2uar0Wy5C9V+osxMR0/iIdxeH0uWOxByUdL7QY4P4MJvAZwhB0yHkJzs
upHZZauM2NseF+MsVU/2rvdBkcwkO9EfSyqTAMR1bpag6ywchZBZfYnATmtqxR7P
52FZQQkdW8f4jsqKnf9B0EOSP+ZNR//RRovox+zAimhycVtse85Eba2egl5VTqNt
f7HqFLB08/g2kil/QKPsY6LCDTxU359A/xQ6N6Gjykj4/9/Ciz8HP7TNvY0eTonk
kidbkpq15iEzcEDK4zXqHgYbumHK8jpdvVOt5vDWiqK/aSXLzx0N31katLcGkCSf
3scN+9zslH29sSp/T10Eh+4iUpGcXy3TfJCa+AYN6ZgMalt2nuBeL2plJQMoJJVr
X7mxvgVMcJEVFjoM0owsLi0cdtsvwvQN20rjNnWFTwfVdu1A5bJmE+4GedGucKbw
aFNmrfrE9+0Gla4BX0klW8kk0zNGCpRlmjS8DqV//yo7LxeI2iNPKzK35ew7IZPN
yo9hUhnqmc3qwk0m+3F5bqQLJ5eei/sKF7kb8R9kUztDVFVLPqyxzb3Rb6AmViSE
3MlvH3ZNasIg/ww5OwzaqIM/aPyOe4GguytJxyQjCsP3mctM5mc=
=ZSyK
-----END PGP SIGNATURE-----