Threats tagged 'ghsa-xxh6-gw5r-86fm'

libmspack versions up to 0.11alpha have an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor. This flaw allows an attacker to craft a malicious MS-ZIP CAB file that causes the decompressor to leak up to 32 KiB of stale heap memory in the extracted output. The vulnerability arises from unchecked back-reference distances in the decompression process.