CVE-2014-9556: Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial...

Security readout for executives and security teams

CVE-2014-9556 is a denial-of-service flaw in libmspack 0.4. A specially crafted CAB archive can make affected decompression code hang, potentially disrupting services that automatically inspect or unpack CAB files from untrusted sources. Exposure is most likely where libmspack 0.4 is installed or embedded and processes untrusted CAB files, especially automated extraction, scanning, or ingestion workflows. The bundle does not prove broader product impact beyond libmspack and downstream distribution packages. Treat this as a service-availability risk, not a confirmed breach risk. Prioritize internet-facing or automated file-processing systems first, then routine package remediation elsewhere. Mitigation focus: Check vendor or distribution advisories for updated libmspack packages.; Update libmspack through supported operating-system or application channels.; Restrict automated processing of untrusted CAB files until vulnerable versions are remediated..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.