CVE-2026-111135: Out-of-bounds Read in libyal libfwsi

The vulnerability exists in libfwsi through version 0, where the function libfwsi_mtp_volume_values_read_data() improperly reads heap memory out-of-bounds when processing crafted MTP volume shell items. An attacker can embed specially crafted shell items within .lnk files, jump lists, or shell bags to trigger this condition. This leads to reading past allocated buffer limits, potentially causing process crashes. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high impact on availability.

Successful exploitation results in a heap out-of-bounds read that can cause consuming processes to crash, impacting availability. There is no indication of privilege escalation, information disclosure beyond the out-of-bounds read, or code execution. The attack requires local access and user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening or processing untrusted .lnk files, jump lists, or shell bags that may contain maliciously crafted MTP volume shell items.