CVE-2026-119602

A flaw was found in libmspack. The MS-ZIP decompressor fails to properly validate back-reference distances when decompressing cabinet CAB archive files. By providing a specially crafted archive whose initial block starts with a back-reference, an attacker can cause the extraction routine to copy...