CVE-2026-110602: 
Clam AntiVirus vulnerability analysis and mitigation

CVE-2026-110602 is an uninitialized pointer free vulnerability in libmspack through version 0.11alpha, affecting the kwajd_open() function in mspack/kwajd.c. When a header read error occurs during KWAJ file parsing, the kwajd_close() cleanup routine calls free() on the filename and extra pointer fields of the header structure before they have been initialized to NULL, resulting in undefined behavior. The vulnerability was disclosed on October 14, 2026, with a patch committed to the libmspack repository on the same date. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified under CWE-763 (Release of Invalid Pointer or Reference) and CWE-824 (Access of Uninitialized Pointer). In the vulnerable code path (kwajd_read_headers() in mspack/kwajd.c, lines 111–181), the hdr->filename and hdr->extra pointer fields are only initialized to NULL after the initial header read and signature check — meaning any early return due to a read failure or wrong signature leaves these fields containing uninitialized heap memory. When kwajd_open() calls kwajd_close() on error, free() is invoked on these uninitialized pointers, which constitutes undefined behavior and can yield a controlled arbitrary-free primitive if the heap contains attacker-influenced data at those offsets (GitHub Commit, PoC Write-up). The attack vector is local and requires user interaction (e.g., an application processing an attacker-supplied file), with no privileges required.

Successful exploitation can cause the hosting process to crash (denial of service) or, under favorable heap layout conditions, yield an arbitrary-free memory corruption primitive that could potentially be leveraged for further exploitation. Integrity and availability of the vulnerable system are both rated High, while there is no direct confidentiality impact. The scope is limited to the vulnerable system itself, with no lateral movement capability demonstrated in current public research (Github Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available on HackMD, demonstrating that supplying an empty or truncated KWAJ file (e.g., a zero-byte crash.kwj) to a vulnerable application is sufficient to trigger the crash via the uninitialized pointer free (PoC Write-up). The NVD SSVC assessment classifies exploitation status as "poc" and notes the vulnerability is not automatable. The EPSS score is 0.0, indicating very low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Red Hat Advisory).

1. Identify target application: Locate a local application that uses libmspack's KWAJ decompressor (version ≤ 0.11alpha) to open user-supplied or externally sourced .kwj files.
2. Craft malformed KWAJ file: Create a trigger artifact — the simplest is a zero-byte (empty) file, or a file shorter than the 14-byte KWAJ header (kwajh_SIZEOF), or a file with an incorrect KWAJ signature. In Python: open('crash.kwj', 'wb').write(b'').
3. Supply the file to the target: Provide the malformed file as input to the vulnerable application (e.g., via a file open dialog, a watched directory, or a command-line argument), causing kwajd_open() → kwajd_read_headers() to be invoked.
4. Trigger the error path: The short read (or signature mismatch) causes kwajd_read_headers() to return an error before hdr->filename and hdr->extra are initialized to NULL.
5. Uninitialized free occurs: kwajd_open() calls kwajd_close() on error, which calls free(hdr->filename) and free(hdr->extra) on uninitialized pointer values, causing a crash (SIGSEGV) or, with a groomed heap containing a planted pointer value, a controlled arbitrary-free primitive (PoC Write-up, GitHub Commit).

• File System: Presence of zero-byte or malformed .kwj files in directories monitored or processed by libmspack-dependent applications; unexpected crash dump files (core dumps) generated by the application process.
• Logs: Application crash logs or system logs (e.g., dmesg, journalctl) showing SIGSEGV or heap corruption errors originating from a libmspack-linked process; AddressSanitizer (ASan) reports referencing kwajd_close or free() with invalid pointer values.
• Process: Unexpected termination of applications that process KWAJ archives; child processes or crash reporters spawned unexpectedly following file open operations on .kwj files.

The libmspack maintainer (Stuart Caie) released a fix in commit 4d868504 that initializes hdr->filename and hdr->extra to NULL at the very beginning of kwajd_read_headers(), before any early-return error paths are reached. Users should update libmspack to any version newer than 0.11alpha that includes this commit (GitHub Commit). As a workaround where patching is not immediately possible, restrict local access to systems that process KWAJ files, validate KWAJ file format and signatures before passing files to libmspack, and monitor for unexpected process crashes in libmspack-dependent applications (Red Hat Bugzilla).

Red Hat opened a Bugzilla tracking entry (Bug 2552272) on October 14, 2026, classifying the issue as medium severity and assigning it to the Product Security DevOps Team (Red Hat Bugzilla). The vulnerability was also noted on the Mastodon-based infosec.exchange CVE feed shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the original PoC write-up has been observed.