CVE-2026-111140 in libregf
Summary
by MITRE • 10/15/2026
libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in libregf, specifically affecting versions up through May 26, 2026, represents a critical memory safety flaw rooted in improper bounds checking during the parsing of Windows Registry hive files. This heap out-of-bounds read occurs within the function libregf_value_item_read_value_data(), which is responsible for extracting and processing value data from REGF structures. The core technical deficiency lies in how the library calculates the valid size range for reading cell data. Specifically, when handling older format cells corresponding to version 1.0 or 1.1 of the registry hive structure, the parser fails to account for a four-byte offset that precedes the actual value data payload. By neglecting to subtract this fixed-size header from the total allocated buffer size before performing read operations, the library effectively extends its memory access window beyond the intended boundaries of the specific cell being processed.
This arithmetic error creates a scenario where an attacker can craft a malicious REGF hive file designed to exploit this miscalculation. By carefully constructing a value data cell that terminates at or near the end of a hive bin, and leveraging the missing offset subtraction, the parser is instructed to read memory locations immediately following the legitimate data buffer. This results in reading adjacent heap bytes that contain unrelated application state, potentially exposing sensitive information such as cryptographic keys, session tokens, or other private data stored in nearby memory allocations. The vulnerability does not necessarily require code execution on its own but serves as a powerful primitive for information disclosure and stability disruption within any software stack utilizing libregf for registry analysis.
The operational impact of this flaw is significant for security tools that rely heavily on automated parsing of Windows Registry artifacts, such as forensic frameworks like plaso or standalone utilities like regfexport. When these applications process the crafted hive file, they may crash due to accessing unmapped memory pages if the adjacent heap region is not committed, leading to a denial-of-service condition against the analysis tool itself. Alternatively, if the adjacent memory contains valid data accessible by the operating system's virtual memory manager, the application will silently leak that information into its output or internal state without raising an immediate error. This undermines the integrity of forensic investigations and automated threat hunting pipelines where accurate and secure parsing is paramount.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities involving memory regions outside the intended buffer boundaries. It also relates to CWE-680 regarding Integer Overflow or Wraparound if the calculation logic involved arithmetic operations that exceeded variable limits, though in this specific case, it is primarily a logical error in offset subtraction rather than pure integer overflow. In terms of adversary behavior mapping under MITRE ATT&CK, this flaw facilitates Data from Information Repositories via Tertiary Software and potentially supports Initial Access or Collection phases if the leaked data provides footholds for further exploitation within an enterprise environment.
To mitigate this risk, developers must update libregf to version 20260527 or later, where the logic in libregf_value_item_read_value_data() has been corrected to properly subtract the four-byte old-format cell offset before validating and reading data boundaries. For organizations unable to immediately patch their dependencies, implementing strict input validation at the ingestion layer of forensic pipelines can help detect malformed hive structures that exhibit signs of this specific boundary violation pattern. Additionally, enabling Address Sanitizer (ASan) or similar memory error detection tools during development and testing phases is recommended to catch such off-by-one errors before they reach production environments. Regular auditing of third-party library versions used in security tooling remains essential to prevent exploitation of known parsing flaws that compromise both confidentiality and availability.