CVE-2026-116736

MEDIUM 6.1

libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.

CWE	CWE-125
Vendor	libyal
Product	libpff
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for libyal libpff

Be the first to know when new medium vulnerabilities affecting libyal libpff are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

libyal / libpff

0 ≤ 20260926

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/libyal/libpff/issues/172 github.com: https://github.com/libyal/libpff github.com: https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266 github.com: https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L8858-L8895 hackmd.io: https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads vulncheck.com: https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-values-array

Credits

HaiND from the Post and Telecommunication Institute of Technology