{"id":"CVE-2026-110598","summary":"Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value","details":"Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.","modified":"2026-10-15T02:47:30.126802498Z","published":"2026-10-14T14:16:40.986Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110598.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110598.json"},{"type":"PACKAGE","url":"https://github.com/libyal/libpff"},{"type":"ARTICLE","url":"https://github.com/libyal/libpff/blob/03545511ab7a7a609e50ec715bdd3985c3be71c5/libpff/libpff_multi_value.c#L207-L271"},{"type":"ARTICLE","url":"https://github.com/libyal/libpff/blob/03545511ab7a7a609e50ec715bdd3985c3be71c5/libpff/libpff_record_entry.c#L2825-L2874"},{"type":"ADVISORY","url":"https://hackmd.io/@haind-pwn/libpff-multivalue-offset-underflow-oob-read"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110598"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libyal-libpff-through-20260926-heap-out-of-bounds-read-via-libpff-record-entry-get-multi-value"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libyal/libpff","events":[{"introduced":"0"},{"last_affected":"03545511ab7a7a609e50ec715bdd3985c3be71c5"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"20260926"}]}}],"versions":["20260926","20231205"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110598.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}