{"id":"CVE-2026-111147","summary":"Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value","details":"Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.","modified":"2026-10-17T07:05:00.963902623Z","published":"2026-10-15T18:57:37.431Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111147.json"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111147.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111147"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libyal-libesedb-through-20260704-heap-out-of-bounds-read-via-libesedb-record-get-multi-value"},{"type":"PACKAGE","url":"https://github.com/libyal/libesedb"},{"type":"ARTICLE","url":"https://github.com/libyal/libesedb/blob/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350/libesedb/libesedb_record.c#L3776-L3830"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/libesedb-multi-value-offset-table-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libyal/libesedb","events":[{"introduced":"0"},{"fixed":"cf49b6d420d4a44dcd6355bc0d6b36f9f580f350"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"20260704"},{"fixed":"20260704"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["20240420"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111147.json","vanir_signatures":[{"digest":{"line_hashes":["147441126085707583367058371241725304190","96555596472594281644078138349033722148","32925642106197462597006126496872028410","33781096038386191599858348658523257051","132673904009414191282484475335516960806","146200942179132475587535501060814563287","196352970771743339145183663066650027631","156316539431174137381370295421542320468","29663195952854124560090659973342983630","50572599611073955804735036384345006657"],"threshold":0.9},"id":"CVE-2026-111147-014a6cb0","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"esedbtools/esedbinfo.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_i18n.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["82221897215185159941085409735219947691","317473503416083710664399676800276181972","305009383348102277634976049858090826475","303574942071297852055282220395303961402"]},"id":"CVE-2026-111147-0d6cc36e"},{"signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_file.c"},"deprecated":false,"digest":{"line_hashes":["225707689472813037867050932188301176928","41830238106151531470844040453737563039","162975879556437931819195500561934007177","48944238156765464037267046125549868580","36025276220624794467031886125741094215","7786056528863165948716776007033677832","327629969608357348953966002655438963557","226582380750838468071208265890308908838","181882200804261838145941045990297807173","273398929696447532786019958073814569971","127415515075464744080019048968498983451","294749014688355584652852170347685684180","65545255655954252135827100679159134639"],"threshold":0.9},"id":"CVE-2026-111147-5513024e","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["324467337094505052926249136556244255218","254661059991620699223535150353126783805","35142571634366545821586842623549272272"],"threshold":0.9},"id":"CVE-2026-111147-60618ee5","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_io_handle.h"}},{"id":"CVE-2026-111147-776ab507","signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_i18n.c","function":"libesedb_i18n_initialize"},"deprecated":false,"digest":{"function_hash":"214506623075795869152812456867783374394","length":511}},{"signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"esedbtools/info_handle.c","function":"info_handle_file_fprint"},"deprecated":false,"digest":{"function_hash":"226541527876462891187053555539032545662","length":3365},"id":"CVE-2026-111147-9bbc00e0","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_file.c","function":"libesedb_file_open_read"},"deprecated":false,"digest":{"length":11132,"function_hash":"214427880698035285715133410793613121549"},"id":"CVE-2026-111147-9e3580ac"},{"target":{"file":"esedbtools/info_handle.h"},"deprecated":false,"digest":{"line_hashes":["130601333721540838380630657327581214193","313215582234728299509266081392052064855","124773999248862852391933556883020290337"],"threshold":0.9},"id":"CVE-2026-111147-a9d27806","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350"},{"id":"CVE-2026-111147-c1efefc2","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"esedbtools/info_handle.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["161440282410068247790494781688927783857","121385534976374378767543469369192612499","38160340208786791101605668118001676966","81636995452221559064990573391059138030","316011422232355693391917860681087179361","32306779238321548064218196360714160772","147689870804647996421809418403670624401","222838858970313103329804082171255184324","137958609225276459639030555389421074903","10489671723768125472134719444347032091"]}},{"source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_file.h"},"deprecated":false,"digest":{"line_hashes":["71362314208312792896448100393227511281","154610309425137157149219579335534814060","273239615112170118465739083173658051591"],"threshold":0.9},"id":"CVE-2026-111147-dcac86d8","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/libyal/libesedb/commit/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350","target":{"file":"libesedb/libesedb_i18n.c"},"deprecated":false,"digest":{"line_hashes":["317473503416083710664399676800276181972","305009383348102277634976049858090826475","15940655532078854408111206574312954091","241898932118740050243422537166357131159","94369331446080480208879349816731552626","99457110407704968677463228604653661762","169500684990936619647530809095836733517","152355241634028303320703465036926866961","302481067158720659943955406748775264736","333030291396640593274520456427238558952","218973655326955971827806599973201106773"],"threshold":0.9},"id":"CVE-2026-111147-fec085ea","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-17T07:05:00Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}