On this page (6 sections)
Ubuntu issued security notice USN-8973-1 on 3 November 2026. It concerns libmspack, a library that reads Microsoft compression formats, and a bug in its error handling for KWAJ archive headers. According to Ubuntu, a specially crafted file could make software using the library crash or possibly run code.
If you look after Ubuntu servers, mail gateways, file-processing pipelines or desktops, check whether the package is present and install the update. On most systems this is an ordinary package upgrade.
What happened
Ubuntu says libmspack left some pointers uninitialized on an error path taken while parsing KWAJ archive headers. A remote party could possibly abuse this to crash the library (a denial of service) or to execute arbitrary code. The overview line of the notice frames the outcome as a crash or programs running as the user who opened the file.
The notice lists a single identifier, CVE-2026-110602. It gives no CVSS score, no explanation of how the flaw would be reached in practice, and nothing about attacks in the wild. Ubuntu is the only publisher covering this so far, so treat anything beyond the notice as unconfirmed.
The weakness in plain terms
An uninitialized pointer is a variable that refers to memory the program never prepared. If a parser fails partway through a file, cleanup code can end up using that unset value. Depending on what the memory holds, the outcome ranges from a plain crash to memory corruption that an attacker may be able to steer. That range explains why the notice says denial of service or possibly code execution.
KWAJ is one of the compressed formats libmspack can read, and the trigger is a malformed header. The risk therefore centers on software that opens files it did not create, such as antivirus engines, mail scanners, converters and upload handlers. Whether a particular application on your system uses libmspack this way depends on the application, and the notice does not name any.
Who is affected
Four Ubuntu releases are listed. The package name differs between them, which matters when you compare versions.
| Ubuntu release | Package | Fixed version |
|---|---|---|
| 26.10 | libmspack0t64 | 0.11-1.1ubuntu0.26.10.1 |
| 26.04 LTS | libmspack0t64 | 0.11-1.1ubuntu0.26.04.1 |
| 24.04 LTS | libmspack0t64 | 0.11-1.1ubuntu0.24.04.1 |
| 22.04 LTS | libmspack0 | 0.10.1-2ubuntu0.1 |
Servers that never handle untrusted compressed files are less exposed in practice. Still, the library is often installed as a dependency, so verify instead of assuming. Other distributions and upstream libmspack releases are outside this notice, and the research does not say whether they are affected.
How to check your exposure
This read-only command lists the libmspack package and its installed version on Ubuntu. No output means the library is not installed; if a version appears, compare it with the table above.
dpkg -l | grep libmspackTo see which installed packages rely on the library, and so hint at what reads files through it, run this read-only query. On 22.04 LTS use libmspack0 in place of libmspack0t64.
apt-cache rdepends --installed libmspack0t64What to do now
Ubuntu says a standard system update brings in the fix, and applications that link to the shared library benefit automatically. The commands below refresh package lists, install available upgrades and then show the resulting libmspack version.
sudo apt update && sudo apt upgrade
dpkg -l | grep libmspack0 of 7 done
Detection and monitoring
The notice contains no indicators of compromise, so there is nothing specific to hunt for. A crash is the most direct outcome it describes, so watch for unexpected segmentation faults in services that handle uploaded or mailed files. System logs and service supervisor restart records are good places to look.
For public websites, patch the operating system as well as the application. A free malware scanner and continuous monitoring can help you spot changes on a site, but they do not replace patching the server. For the broader routine, see our guide to small business website security.
Other Ubuntu notices from the same period are covered in our posts on GVfs vulnerabilities and BIND vulnerabilities.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.