CVE-2026-111135

2th percentile - higher than 2% of all known CVEs

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows reading past buffer bounds via crafted MTP volume shell items. An attacker can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.

An attacker can crash applications processing untrusted .lnk, jump list or shell bag files (denial of service) or potentially leak memory data. The risk affects forensic tools and systems analyzing Windows shell data.

Update libfwsi to a patched version and avoid processing untrusted .lnk, jump list and shell bag files until the fix is applied. Monitor libfwsi consumers for unexpected crashes.