CVE-2026-110598 in libpff
Summary
by MITRE • 10/14/2026
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Libyal's libpff library represents a critical security flaw rooted in improper handling of integer arithmetic during the processing of Microsoft Outlook data files. Specifically, the issue resides within the function libpff_record_entry_get_multi_value(), which is responsible for parsing multi-value properties found in PST, OST, and PAB file formats. These file types are commonly used to store emails, contacts, calendar entries, and other personal information management data. The core technical flaw involves an integer underflow condition that occurs when the library processes non-monotonic offsets associated with multi-value property types such as PT_MV_STRING8, PT_MV_UNICODE, or PT_MV_BINARY. In a correctly implemented parser, offset values for multi-value arrays are expected to be sorted in ascending order to ensure predictable memory access patterns. However, an attacker can craft malicious input files where these offsets decrease rather than increase, leading the library to perform arithmetic operations that result in negative index calculations due to unsigned integer wraparound or insufficient bounds checking before subtraction.
This underflow directly facilitates a heap out-of-bounds read vulnerability. When the parser attempts to access memory based on the miscalculated offset derived from the non-monotonic values, it reads data beyond the allocated buffer boundaries. This behavior aligns with CWE-190 (Integer Overflow or Wraparound) as the root cause and CWE-125 (Out-of-bounds Read) as the direct consequence. The operational impact of this flaw is significant because libpff is often used by various downstream tools, including pypff for Python-based analysis and pffexport for data extraction. A successful exploit allows an attacker to trigger a crash in these applications, resulting in a denial of service against systems relying on the library for file processing. More critically, the out-of-bounds read exposes adjacent heap memory contents to the application process. This can lead to information disclosure where sensitive data residing in nearby memory locations is leaked back through the output stream or error messages generated by the crashing software.
From a threat modeling perspective, this vulnerability enables remote code execution scenarios if combined with other exploitation techniques, although the primary immediate risk here is information leakage and service disruption. The attack vector aligns with ATT&CK technique T1059 (Command and Scripting Interpreter) in contexts where pypff is used within automated scripts, or more broadly with data exfiltration tactics via memory scraping. Attackers can distribute malicious PST files through phishing emails or compromised shared drives, waiting for a user to open them using vulnerable software that integrates libpff. The lack of strict validation on the monotonicity and range of offset values before arithmetic operations allows this exploitation path to remain viable across multiple versions up to 20260926.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Users should immediately update libpff to a version that includes fixes for the integer underflow in libpff_record_entry_get_multi_value(). For organizations unable to upgrade instantly, implementing input validation at the ingestion layer is crucial. This involves sanitizing incoming PST, OST, or PAB files by verifying that multi-value offsets are strictly non-decreasing before passing them to the parsing engine. Additionally, enabling Address Sanitizer (ASan) during development and testing phases can help detect such memory access violations early in the software lifecycle. Security teams should also monitor for unusual memory usage patterns or crashes associated with file processing services as indicators of potential exploitation attempts.