libfwsi up to 20260522 contains a heap out‑of‑bounds read flaw in the libfwsi_mtp_volume_values_read_data function. By embedding a crafted 10 to 53‑byte MTP volume shell item with an item data size of 44 or more inside a .lnk file, jump list or shell bag, an attacker can cause the library to read past the buffer boundaries. The vulnerable read does not trigger a direct code execution path, but it can expose memory contents and typically leads to a crash of any process that processes the malicious shell item.

The affected package is libyal's libfwsi, with the vulnerability present in all releases up to and including the 20260522 build. No specific patch version is listed in the CNA data, but the issue has a known fix in later releases.

The CVSS score of 6.9 places the vulnerability in the moderate range and the EPSS score of less than 1 % indicates that exploitation is expected to be rare. The flaw is not listed in the CISA KEV catalog. An attacker can embed the malicious item in a file that any user may open; the vulnerability does not require elevated privileges. The primary risk is application‑level denial of service and potential accidental exposure of process memory.