Read the docs
TI-2026-74931 Aliases CVE-2026-111147

Heap out-of-bounds read in libyal libesedb multi-value handling

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Libyal libesedb through 20260704 contains a heap out-of-bounds read in libesedb_record_get_multi_value() caused by unbounded multi-value offset tables (CWE-125). If a user processes a crafted ESE/EDB database with esedbexport, an attacker who supplies that database can crash the application or expose up to about 32 KiB of adjacent heap memory. The references link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libyallibesedbup to 20260704—No fix listedCNA
  • libesedb Vendorlibyal Affected up to 20260704 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libyal libesedb.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111147
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-16 CISA SSVC decision points changed
  6. 2026-10-16 Priority changed: LOW → MEDIUM

References

Exploit 1

Other 2

  • TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
  • TI-2026-80944 Heap out-of-bounds read in libpff table record parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74943 Heap out-of-bounds read in libewf L01 extended attribute parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74919 libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data CVSS 4.0MEDIUM 6.9
  • TI-2026-74918 Heap out-of-bounds read in libfwsi MTP file entry parsing CVSS 4.0MEDIUM 6.9
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences