Is CVE-2026-116743 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116743?

CVE-2026-116743 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-116743

Description

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing forensic tools processing it.