LiveActive security incident?Get immediate response
CVE Record

CVE-2019-1010305: libmspack 0.9.1alpha is affected by: Buffer Overflow.

libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-1010305 is a buffer overflow in libmspack 0.9.1alpha triggered when a user opens a malicious CHM file. Sources describe information disclosure, not system takeover. Business urgency is highest where CHM files are processed from email, web downloads, support portals, or archival workflows.

Executive priority

Treat this as a targeted remediation item, not an emergency. Prioritize systems that process CHM files from external parties, then close remaining package exposure through normal vulnerability management.

Technical view

The flaw is in chmd_read_headers() in libmspack/mspack/chmd.c. A specially crafted CHM file can trigger a buffer overflow during header parsing. The CVE lists the fixed version as after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d. No CVSS, CWE, or CISA KEV listing is provided.

Likely exposure

Exposure is likely on Linux systems or applications that package libmspack 0.9.1alpha or use it to parse CHM archives. Risk increases when users or automated services open untrusted CHM files.

Exploitation context

The cited attack path requires the victim or a service to open a specially crafted CHM file. The source bundle does not cite active exploitation, public exploit use, or inclusion in CISA KEV.

Researcher notes

Evidence identifies the vulnerable function, affected version, trigger file type, impact, and fix commit. Severity metadata is incomplete: no CVSS, CWE, or exploitation evidence appears in the provided sources. Distribution advisories indicate downstream security updates were issued.

Mitigation direction

  • Upgrade libmspack to a version after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
  • Apply relevant Ubuntu, Fedora, or Debian security updates where applicable.
  • Restrict untrusted CHM file handling in email, upload, and document-processing workflows.
  • Check vendor guidance for packaged application dependencies that embed libmspack.

Validation and detection

  • Inventory installed libmspack packages and embedded copies in applications.
  • Confirm versions are newer than 0.9.1alpha or include the referenced fix commit.
  • Review CHM ingestion paths, including email gateways, upload processors, and archival tools.
  • Verify OS security advisories have been applied on affected distributions.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-1010305 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
libmspacklibmspack0.9.1alpha [fixed: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d]Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.