Heap Out-of-Bounds Read in libfwsi via MTP Volume Shell Items

Executive Summary

This vulnerability is a heap out-of-bounds read in the libfwsi library affecting the function libfwsi_mtp_volume_values_read_data(). It occurs when parsing MTP volume shell items in files like .lnk, jump lists, or shell bags. Attackers can craft a shell item of 10 to 53 bytes with an item data size of 44 or more, causing the parser to read memory beyond the allocated buffer. This may lead to crashes in consuming processes.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for affected libfwsi versions and analyzing files like .lnk, jump lists, or shell bags for crafted MTP volume shell items. Inspect system logs for crashes in processes using libfwsi. Use tools like strings or hex editors to examine binary data in these files for shell items with sizes between 10-53 bytes and item data size of 44 or more.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash applications that process .lnk files, jump lists, or shell bags by embedding specially crafted shell items. While arbitrary code execution or information leaks are not confirmed, the crashes could disrupt system functionality or lead to denial-of-service conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes process crashes due to heap out-of-bounds reads, which does not directly lead to data exposure or unauthorized access. However, compliance risks may arise if the affected library is used in systems handling sensitive data under GDPR or HIPAA, as crashes could disrupt data processing or availability. No confirmed evidence of information leaks or arbitrary code execution exists.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libfwsi to the latest version beyond 20260522. If updating is not possible, disable or restrict access to applications using libfwsi, especially those parsing .lnk files or shell items. Monitor for crashes in processes linked to libfwsi and block suspicious .lnk or shell bag files.

Useful 0 Not Useful 0