Read the docs
TI-2026-80944 Aliases CVE-2026-116735GHSA-vvjh-vch2-576w

Heap out-of-bounds read in libpff table record parsing

Priority MEDIUM 64CWE-193Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that lets attackers trigger a heap out-of-bounds read. Attackers supply crafted PST, OST or PAB files to applications such as pffexport or pypff, which can read adjacent heap memory or crash. Exploitation requires passive user interaction (CVSS UI:P), and the flaw is classified as CWE-193.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libyallibpffup to 20260926—No fix listedCNA
  • libpff Vendorlibyal Affected up to 20260926 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libpff.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116735
  2. 2026-10-27 Alias added: GHSA-vvjh-vch2-576w
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-05 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 3

  • TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
  • TI-2026-74943 Heap out-of-bounds read in libewf L01 extended attribute parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74931 Heap out-of-bounds read in libyal libesedb multi-value handling CVSS 4.0MEDIUM 6.9
  • TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74919 libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data CVSS 4.0MEDIUM 6.9
  • TI-2026-74918 Heap out-of-bounds read in libfwsi MTP file entry parsing CVSS 4.0MEDIUM 6.9
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences