CVE-2026-116736
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
Risk Assessment
Heap memory data leakage or application crashes may occur when processing mail files. Organizations analyzing PST/OST/PAB files are exposed to information disclosure and disruption.
Recommendation
Update libpff to a version newer than 20260926 if available, or apply the vendor patch. Restrict processing of untrusted PST, OST and PAB files until updated.
Other vulnerabilities in libpff
See all- CVE-2026-116735Medium
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
- CVE-2026-110598Medium
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.
Original NVD description (English source)
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS