---
id: CVE-2026-116735
title: >-
  libpff through 20260926 Heap Out-of-Bounds Read via
  libpff_table_read_6c_record_entries
summary: >-
  libpff through 20260926 contains an off-by-one bounds check in
  libpff_table_read_6c_record_entries that allows attackers to trigger a heap
  out-of-bounds read via crafted 6c table record entries. Attackers can supply
  crafted PST, OST or P…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-193
vendor: libyal
product: libpff
affected:
  - libpff <= 20260926
published: '2026-10-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T10:14:06.821Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116735'
references:
  - url: 'https://github.com/libyal/libpff/issues/172'
    label: 'GitHub Issue #172'
  - url: 'https://github.com/libyal/libpff'
  - url: >-
      https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266
  - url: >-
      https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L5431-L5445
  - url: 'https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads'
  - url: >-
      https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-6c-record-entries
    label: >-
      VulnCheck Advisory: libpff through 20260926 Heap Out-of-Bounds Read via
      libpff_table_read_6c_record_entries
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02245
ingestedAt: '2026-10-27T16:11:59.265Z'
---

## Overview

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.

## Affected

- `libpff <= 20260926`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.