CVE-2026-111134

2th percentile - higher than 2% of all known CVEs

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows reading past buffer bounds via crafted MTP file entry shell items. An attacker can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.

An attacker can crash applications processing untrusted .lnk, jump list or shell bag files (denial of service) or potentially leak memory data. The risk affects forensic tools and systems analyzing Windows shell data.

Update libfwsi to a patched version and avoid processing untrusted .lnk, jump list and shell bag files until the fix is applied. Monitor libfwsi consumers for unexpected crashes.