Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.