Back to Security Advisories

Libmspack Vulnerability — Ubuntu Security Update (USN-8973-1)

USN-8973-1 fixes a libmspack flaw on Ubuntu: uninitialized pointers while reading KWAJ archive headers can crash the parser or execute arbitrary code as the user (CVSS 6.3). Update: sudo apt update && sudo apt upgrade libmspack and restart any services parsing CAB/KWAJ archives.

Critical 6.3 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Uninitialized pointers in archive parsing are a code-execution primitive: a crafted KWAJ file opened by an antivirus scanner or archive tool runs attacker code as that service's user.

  1. Ubuntu Security Notices

  2. USN-8973-1

Publication date

3 November 2026

Overview

libmspack could be made to crash or run programs as your login if it
opened a specially crafted file.

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • libmspack – library for Microsoft compression formats

Details

It was discovered that libmspack did not properly initialize pointers
when handling errors while reading KWAJ archive headers. An attacker
could possibly use this issue to cause libmspack to crash, resulting
in a denial of service, or execute arbitrary code.

It was discovered that libmspack did not properly initialize pointers
when handling errors while reading KWAJ archive headers. An attacker
could possibly use this issue to cause libmspack to crash, resulting
in a denial of service, or execute arbitrary code.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10 stonking libmspack0t64 –  0.11-1.1ubuntu0.26.10.1
26.04 LTS resolute libmspack0t64 –  0.11-1.1ubuntu0.26.04.1
24.04 LTS noble libmspack0t64 –  0.11-1.1ubuntu0.24.04.1
22.04 LTS jammy libmspack0 –  0.10.1-2ubuntu0.1

References

Frequently Asked Questions

What is USN-8973-1?
It is Ubuntu's libmspack security notice: uninitialized pointers while handling errors in KWAJ archive headers could crash libmspack or execute arbitrary code as the user opening the crafted file. CVSS 6.3.
Who is affected?
Systems with libmspack installed where untrusted archives get parsed — antivirus scanners scanning mail attachments and archive tools are the classic paths.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade libmspack and restart any services that link it (mail scanners, archive utilities).
Why would an antivirus trigger this?
AV scanners decompress every archive attachment to inspect contents — a crafted KWAJ attachment reaches the parser before any signature check, which makes archive-library flaws a mail-security staple.

References

Security Advisories

Related Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System