CVE-2026-116736 Details
Description
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
A heap out-of-bounds read vulnerability has been identified in libpff, a library for parsing Microsoft Personal Folder Files, through the version 20260926. The issue arises in the table parsing code, specifically within the 'libpff_table_read_values_array' function. This vulnerability allows attackers to craft PST, OST, or PAB files that, when processed by libpff, cause applications to read adjacent heap memory into record entry values or crash. The root cause is a lack of proper validation for the 'values_array_size' in 7c column definitions, which can lead to unauthorized memory access.
Users are advised to update to the latest version of libpff, where this vulnerability has been addressed. Instructions for updating can be found in the project's documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libyal/libpff | [email protected] | Vendor |
| https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L8858-L8895 | [email protected] | Source CodeVendor |
| https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266 | [email protected] | Source CodeVendor |
| https://github.com/libyal/libpff/issues/172 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-values-array | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libyal/libpff | <= 20260926 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |