libmspack through version 0.11alpha has an uninitialized memory disclosure vulnerability in its MS‑ZIP decompressor. When a crafted MS‑ZIP CAB file begins with a back‑reference, the cabinet extraction routine writes up to 32 KiB of stale heap memory into the decompressed output, allowing an attacker to glean arbitrary data previously stored on the heap. The primary impact is the unintended exposure of sensitive information that could compromise confidentiality of the system using the library.

The vulnerability is confined to the libmspack library, specifically releases up to and including 0.11alpha. Applications that link against libmspack and process MS‑ZIP CAB files are affected. No specific vendor releases are listed beyond the open‑source project, and no version ranges beyond 0.11alpha are included.

The CVSS score of 6.3 indicates medium severity, and the vulnerability is not yet recorded in the CISA KEV catalog. The exploit requires the ability to supply a malicious MS‑ZIP CAB file; an attacker would need local access to the application or control over user‑uploaded cab archives. Because the data leakage occurs during decompression, the attack vector is inferred to be local or through untrusted file processing by the application. Exploitation probability is uncertain due to the lack of EPSS data, but the presence of a practical code path makes the risk notable for systems that routinely handle MS‑ZIP archives.