Is CVE-2026-111134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111134 being exploited in the wild.

How severe is CVE-2026-111134?

Medium severity, with a CVSS score of 6.1, published 15 October 2026.

Which products and versions are affected?

Libyal Libfwsi through 20260522.

Is there a fix for CVE-2026-111134?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111134 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-111134?

Check whether you run Libyal Libfwsi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111134: libfwsi heap out-of-bounds read in MTP file entry parsing

CVE-2026-111134 · Severity: medium · CVSS 6.1 · Published 2026-10-15

libfwsi is a library for parsing Windows Shell Item format data commonly found in .lnk files, jump lists, and shell bags. A heap out-of-bounds read vulnerability allows attackers to crash applications using libfwsi by crafting malicious shell items that trigger buffer over-read, potentially exposing sensitive memory contents. The vulnerability is triggered by processing specially crafted MTP file entry data embedded in Windows shortcut or shell metadata files.

Vendors: Libyal.

Quick answers

Is CVE-2026-111134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111134 being exploited in the wild.
How severe is CVE-2026-111134?: Medium severity, with a CVSS score of 6.1, published 15 October 2026.
Which products and versions are affected?: Libyal Libfwsi through 20260522.
Is there a fix for CVE-2026-111134?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111134 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-111134?: Check whether you run Libyal Libfwsi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the libfwsi_mtp_file_entry_values_read_data() function, which fails to properly validate data bounds when parsing MTP file entry shell items. An attacker can craft a 10–73 byte shell item with an item data size field of 44 bytes or more, causing the parser to read past allocated buffer boundaries. The flaw affects all consumers of libfwsi that process untrusted .lnk files, jump lists, or shell bags; exploitation requires only network or local delivery of a malicious file with no authentication.

Affected products

libyal libfwsi through 20260522

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.