CVE-2026-111140: libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data
libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be reviewed for exposure?
Review libregf installations through 20260526, especially workflows that parse REGF hives from untrusted or externally supplied sources.
What must occur for an attacker to trigger the issue?
A parser must process a crafted version 1.0 or 1.1 REGF hive whose value data cell ends at its hive bin. The issue is triggered during value-data parsing.
Which tools are specifically identified as affected consumers?
The issue can affect parsers such as regfexport and plaso when they process the crafted hive.
What is the expected impact if processing occurs?
The out-of-bounds read can expose adjacent heap bytes and can crash the parser. The supplied severity vector indicates low confidentiality impact, no integrity impact, and high availability impact.