CVE-2015-4468: Multiple integer overflows in the search_chunk function in chmd.c in libmspack before 0.5 allow remote atta...

Security readout for executives and security teams

This flaw can crash software that uses vulnerable libmspack code to read crafted CHM help files. The public record describes denial of service, not data theft or code execution. Business urgency depends on whether untrusted CHM files are accepted, scanned, indexed, or opened in production workflows. Exposure is most likely where applications or services use libmspack before 0.5 to process CHM files from email, uploads, archives, malware triage, search indexing, or user content. The source bundle does not identify specific downstream products. Treat this as a targeted availability risk, not a confirmed breach vector. Prioritize remediation where CHM files enter automated or user-facing processing paths, especially internet-facing upload, scanning, or indexing services. Mitigation focus: Upgrade libmspack to version 0.5 or a vendor-patched package.; Apply the Debian pointer-arithmetic overflow patch where backporting is required.; Limit or isolate CHM parsing for untrusted files until patched..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.