libyal/libpff vulnerabilities

Latest libyal/libpff CVEs

Newest publication first

1. CVE-2026-116736 libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

   Published 2026-10-26

   Medium·CVSS 6.9 EPSS 0.13%

   Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications re...

2. CVE-2026-116735 libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries

   Published 2026-10-26

   Medium·CVSS 6.9 EPSS 0.13%

   libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or...

3. CVE-2026-110598 Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value

   Published 2026-10-14

   Medium·CVSS 6.9 EPSS 0.17%

   Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UN...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.