Heap Out-of-Bounds Read in libfwsi

Executive Summary

libfwsi through 20260522 has a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data(). Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers by reading past buffer bounds.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for applications using libfwsi versions through 20260522. Inspect .lnk files, jump lists, and shell bags for crafted MTP file entry shell items with sizes between 10-73 bytes and item data size of 44 or more. Use file analysis tools to examine these artifacts for malformed structures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libfwsi to crash when processing maliciously crafted .lnk files, jump lists or shell bags. It may lead to denial of service or potential information disclosure if sensitive memory is exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive data through heap out-of-bounds reads. Attackers could access memory beyond buffer limits, potentially leaking personal or health information stored in .lnk files, jump lists, or shell bags. This could violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule on integrity and confidentiality).

Useful 0 Not Useful 0

Mitigation Strategies

Update libfwsi to the latest version beyond 20260522. If updating is not possible, restrict access to applications using libfwsi, especially those processing .lnk files, jump lists, or shell bags. Monitor for crashes in libfwsi consumers as potential exploitation indicators.

Useful 0 Not Useful 0