ZeroDay Findings
Sign inSign up

Findings

CVE-2026-111135

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via…

Published Oct 15, 2026 · updated Oct 15, 2026

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.

Sources

  • CVE.orgVulnerability recordCVE-2026-111135

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-111135

    libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more

    nvd.nist.gov

References