CVE-2026-116736— libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

Quick assessment

Affected

libyal libpff

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

截至 2026 年 9 月 26 日，libpff 库在函数中存在堆越界读取漏洞。该漏洞源于未将 7c 列定义中的与剩余缓冲区字节数进行校验。攻击者可构造恶意的 PST、OST 或 PAB 文件，诱导应用程序将相邻的堆内存读取到记录条目值中，或导致应用程序崩溃。

CVSS 6.1 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

Source: CVE Program / CVE List V5

Vulnerability Description

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libyal	libpff	0 ~ 20260926	-

II. Public POCs for CVE-2026-116736

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116736

请登录查看更多情报信息。

Other References for CVE-2026-116736 (6)

https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266 patch
https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L8858-L8895 technical-description
https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads third-party-advisory
https://github.com/libyal/libpff product
https://github.com/libyal/libpff/issues/172 issue-tracking
https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-values-array third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116736

Same Patch Batch · libyal · 2026-10-26 · 6 CVEs total

CVE-2026-116737	6.1 MEDIUM	libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path
CVE-2026-116735	6.1 MEDIUM	libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
CVE-2026-116743	5.5 MEDIUM	libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
CVE-2026-116728	5.5 MEDIUM	libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_
CVE-2026-116729	3.3 LOW	libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_

IV. Related Vulnerabilities

Same product: libpff

Same vendor: libyal

Same weakness: CWE-125