CVE-2019-1010305

Name of the Vulnerable Software and Affected Versions libmspack version 0.9.1alpha

Description The issue is caused by a buffer overflow in the chmd read headers() function in the libmspack library, which can allow a remote attacker to disclose protected information using a specially crafted chm file. The attack vector involves the victim opening a maliciously created chm file.

Recommendations For libmspack version 0.9.1alpha, update to a version after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d to resolve the issue. As a temporary workaround, consider avoiding the use of the chmd read headers() function until a patch is available. Restrict access to specially crafted chm files to minimize the risk of exploitation.