CVE-2026-111147: Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value
Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedbrecordgetmultivalue() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Libyal libesedb through 20260704 are affected when they process ESE/EDB databases with esedbexport. The practical exposure is highest where crafted or untrusted database files can be supplied for processing.
What must an attacker do to trigger the issue?
An attacker needs to provide a crafted ESE/EDB database containing unbounded multi-value offset tables and have it processed by esedbexport. Exploitation can cause a crash or disclose up to about 32 KiB of adjacent heap memory.
How can I determine whether an environment is affected?
Identify whether the environment uses Libyal libesedb through 20260704 and processes ESE/EDB files with esedbexport. Systems that do not process attacker-supplied or otherwise untrusted ESE/EDB databases have a reduced exposure path.