CVE-2026-116735 Details
Description
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
A heap out-of-bounds read vulnerability has been identified in libpff, a library for parsing Microsoft Personal Folder Files, through version 20260926. The issue arises from an off-by-one error in the 'libpff_table_read_6c_record_entries' function, which processes 6c table record entries. This vulnerability allows attackers to exploit crafted PST, OST, or PAB files, leading to unauthorized access of adjacent heap memory or causing application crashes. The flaw is reachable via the public 'libpff_file_open' API, particularly when handling 6c tables that reference values arrays of exactly 16 bytes.
Users can update to the latest version of libpff, where this vulnerability has been addressed. Instructions for updating can be found in the project's documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads | CISA-ADP | BundleTechnical Analysis |
| https://github.com/libyal/libpff | [email protected] | Vendor |
| https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L5431-L5445 | [email protected] | Source CodeVendor |
| https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266 | [email protected] | Source CodeVendor |
| https://github.com/libyal/libpff/issues/172 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-6c-record-entries | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-193 | Off-by-one Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libyal/libpff | <= 20260926 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |