libmspack up to version 0.11alpha includes an uninitialized pointer free in the kwajd_open() routine which occurs when a header read error happens. The function attempts to free memory that was never initialized, creating an arbitrary free primitive. An attacker who supplies a truncated, empty, or incorrectly signed KWAJ file can trigger the crash or memory corruption, which can lead to denial of service or provide a foothold for further exploitation.

The vulnerable component is the libmspack library version 0.11alpha maintained by kyz. Any system that links against this library and processes KWAJ files is affected; no other vendors or product versions are documented.

The CVSS score of 5.8 classifies this flaw as medium severity. The EPSS score is below 1%, and the vulnerability is not listed in CISA's KEV catalog. Attackers can trigger the flaw by supplying a crafted KWAJ file. Based on the description, it is inferred that remote exploitation is possible if the library is used within a network‑exposed application; otherwise a local attacker must provide the malicious file. Elevated privileges or special configuration are not required for exploitation.