kyz CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM kyz CVE published 2026-10-14

CVE-2026-110602

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c. This vulnerability frees unzeroed filename and extra pointers on header read errors, allowing attackers to supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive. Defenders should assess exposure and prioritize pat [truncated]