CVE-2026-111134: Out-of-bounds Read in libyal libfwsi

The vulnerability CVE-2026-111134 affects libfwsi versions up to 20260522, where a heap out-of-bounds read occurs in the function libfwsi_mtp_file_entry_values_read_data(). Attackers can exploit this by embedding a shell item of 10 to 73 bytes with item data size of 44 or more within MTP file entries in .lnk files, jump lists, or shell bags. This crafted input causes the library to read beyond allocated buffer boundaries, leading to application crashes for consumers of libfwsi.

Successful exploitation results in reading memory beyond buffer limits, which can cause application crashes. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact primarily due to denial of service via crashes. There is no indication of privilege escalation or code execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted .lnk files, jump lists, or shell bags containing MTP file entry shell items. Monitoring for updates from libyal is recommended.