Login Request a demo
Medium severity · published Oct 26, 2026
CVE-2026-116735
libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
New
6.1
CVSS
0.1%
EPSS
No
On KEV
Description
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libpff · libyal
through 20260926 · source: vendor
Affected product
LI
libpff
libyal
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116735
github.com
https://github.com/libyal/libpff
github.com
https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L5431-L5445
github.com
https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266
github.com
https://github.com/libyal/libpff/issues/172
hackmd.io
https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads
www.vulncheck.com
https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-6c-record-entries
More from libpff
6.1
CVE-2026-116736
libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
6.1
CVE-2026-110598
Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value