CVE-2026-110598: Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or services that process attacker-supplied PST, OST, or PAB files with libpff or tools built on it, including pypff and pffexport, are exposed. The attacker’s file must contain affected multi-value string or binary data with decreasing offsets.
Does exploitation require local access or user interaction?
The supplied vector indicates local attack access and required user interaction. In practice, a user or automated workflow must open or process a crafted file.
What is the likely impact of a successful exploit?
A crafted file can trigger a heap out-of-bounds read, causing libpff, pypff, or pffexport to crash and potentially exposing adjacent heap memory. The provided severity vector indicates low confidentiality impact, no integrity impact, and high availability impact.
How can I tell whether a file is attempting to trigger the flaw?
The affected condition is non-monotonic, decreasing offsets in PT_MV_STRING8, PT_MV_UNICODE, or PT_MV_BINARY multi-value data. A crash while processing such a PST, OST, or PAB file is consistent with the reported behavior.