A flaw in libfwsi’s MTP file entry parsing routine allows an attacker to trigger a heap out‑of‑bounds read by embedding a crafted MTP shell item in a .lnk file or similar artifact. The read offsets are not properly limited to the buffer size, which can expose memory contents beyond the intended limits. Because the vulnerability resides in the data‑reading code, its impact is primarily a crash (denial of service) or an accidental leak of sensitive data from the heap.

Any installation of libyal’s libfwsi with a version up to and including 20260522 is vulnerable. The vulnerability covers all sub‑versions released on or before that date; installing a build newer than 20260522 removes the flaw.

The CVSS score of 6.9 indicates moderate severity. The EPSS score below 1% suggests a very low but nonzero worldwide exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed active exploitation. The likely attack vector is the delivery of a crafted .lnk file or equivalent shell item to a libfwsi consumer, requiring only the ability to provide the file to the target application, with no special privileges or network access needed.