libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewflefextendedattributereaddata() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes.

Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedbrecordgetmultivalue() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.

libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpvolumevaluesreaddata() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.