Integer Underflow in Libyal's libpff Affects Heap Memory Safety
CVE-2026-110598
6.9MEDIUM
What is CVE-2026-110598?
Libyal's libpff, up to version 20260926, is susceptible to an integer underflow vulnerability within the libpff_record_entry_get_multi_value() function. This flaw allows attackers to exploit non-monotonic multi-value offsets in crafted PST, OST, or PAB files, leading to heap out-of-bounds reads. By using decreasing offsets for PT_MV_STRING8, PT_MV_UNICODE, or PT_MV_BINARY, an attacker can cause the libpff, pypff, or pffexport libraries to crash and potentially expose adjacent heap memory to unauthorized access.
Affected Version(s)
libpff 0 <= 20260926
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology