6.9
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се локално, без особени условия, без вход и след действие от потребителя.
Описание
Оригинално описание
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
Засегнати продукти
- libyal libpff: до 20260926
Вид слабост
История
- 26 октомври 2026 Публикувано
Други уязвимости в libyal libpff
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-116735
- https://nvd.nist.gov/vuln/detail/CVE-2026-116735
- https://github.com/libyal/libpff/issues/172
- https://github.com/libyal/libpff
- https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266
- https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L5431-L5445
- https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads
- https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-6c-record-entries