Heap Out-of-Bounds Read Vulnerability in libpff from libyal
CVE-2026-116735

6.9MEDIUM

Key Information:

Vendor

Libyal

Status
Libpff
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116735?

libpff, maintained by libyal, is susceptible to a heap out-of-bounds read due to an off-by-one error in the libpff_table_read_6c_record_entries function. This vulnerability can be exploited by adversaries through expertly crafted PST, OST, or PAB files. Applications such as pffexport or pypff may process these files, leading to potential unauthorized access to adjacent memory or application crashes. Users are advised to be vigilant and apply any necessary patches to safeguard their systems.

Affected Version(s)

libpff 0 <= 20260926

References

https://github.com/libyal/libpff/issues/172
issue-tracking
https://github.com/libyal/libpff
product
https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.