Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
Impact
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.
Source excerpt · VulnCheckAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
libyal · libpff
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 through 20260926 (inclusive) | affected |
Original source description
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.
References
- Source reference hackmd.io/@haind-pwn/libpff-multivalue-offset-underflow-oob-read
- Source reference github.com/libyal/libpff/blob/03545511ab7a7a609e50ec715bdd3985c3be71c5/libpff/libpff_record_entry.c
- Source reference github.com/libyal/libpff/blob/03545511ab7a7a609e50ec715bdd3985c3be71c5/libpff/libpff_multi_value.c
- Security advisory www.vulncheck.com/advisories/libyal-libpff-through-20260926-heap-out-of-bounds-read-via-libpff-record-entry-get-multi-value