# libmspack vulnerability in Ubuntu allows arbitrary code execution via KWAJ headers

> **Key takeaway:** A pointer initialization error in libmspack's KWAJ archive header handling can lead to denial of service or arbitrary code execution.

**Published:** 2026-11-03T14:42:47+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/libmspack-vulnerability-in-ubuntu-allows-arbitrary-code-exec.html 

## Summary
Ubuntu has released security updates for libmspack to address CVE-2026-110602. The vulnerability stems from improper pointer initialization during error handling when the library processes KWAJ archive headers.

Users running Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, or 26.10 are affected if they process specially crafted files. The flaw could allow an attacker to trigger a program crash or execute arbitrary code with the privileges of the logged-in user.

## Technical details of CVE-2026-110602
- **Attack Vector:** Processing of specially crafted KWAJ archive files.
- **Impact:** Potential for denial of service (DoS) via application crashes or arbitrary code execution.
- **Affected Component:** libmspack library, specifically the KWAJ archive header reading logic.

## Why it matters
Since libmspack is a library used for handling Microsoft compression formats, any application on Ubuntu that relies on it to parse KWAJ archives is potentially vulnerable. System administrators should ensure all packages are updated via standard system updates to mitigate the risk of local privilege escalation or service disruption.