CVE-2026-111147 in libesedb
Summary
by MITRE • 10/15/2026
Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in libesedb, specifically within versions through July 4, 2026, represents a critical security flaw located in the function libesedb_record_get_multi_value(). This library is widely utilized for parsing Extensible Storage Engine (ESE) databases, commonly known as EDB files, which are foundational to Microsoft Exchange Server and other enterprise data storage systems. The core technical deficiency stems from an improper validation of multi-value offset tables during the record retrieval process. When processing a crafted or maliciously constructed ESE database file, the function fails to adequately bound-check the offsets provided within these tables. This lack of rigorous input validation allows for a heap out-of-bounds read condition, where the application attempts to access memory locations that lie beyond the allocated buffer boundaries associated with the record data structure.
From an operational perspective, this vulnerability poses significant risks related to both availability and confidentiality. An attacker who can supply a specially crafted EDB file to be processed by tools such as esedbexport or any other software utilizing libesedb for parsing can trigger this flaw. The immediate consequence of exploiting this heap out-of-bounds read is the potential crash of the application, leading to a denial of service scenario where legitimate users are unable to access critical data services. More severely, because the vulnerability involves reading memory adjacent to the allocated buffer, it enables information disclosure attacks. Depending on the specific memory layout and runtime environment, an attacker may be able to extract up to approximately 32 KiB of sensitive heap memory contents. This exposed memory could contain cryptographic keys, authentication tokens, or other proprietary data structures that were previously stored in nearby allocations, thereby compromising the confidentiality of the system's operational state.
This flaw is technically classified under CWE-125, which denotes Out-of-bounds Read, a category of vulnerabilities where software reads past the end of an allocated buffer. The exploitation technique aligns with ATT&CK tactic T1083, specifically the Data from Local System subcategory, as it involves extracting data directly from the memory space of the local process without necessarily executing arbitrary code. While this specific instance is a read-only vulnerability and does not inherently allow for remote code execution in its current form, information disclosure vulnerabilities are often precursors to more severe exploits. Attackers may use leaked heap contents to bypass security controls or as part of complex attack chains that lead to memory corruption issues such as heap overflows if the disclosed data reveals internal pointers or size fields.
Mitigation strategies for this vulnerability primarily involve updating libesedb to a version released after July 4, 2026, where the developers have presumably implemented stricter bounds checking on multi-value offset tables. For organizations unable to immediately update their dependencies, defensive measures should include implementing strict input validation at the application layer before passing EDB files to the library for parsing. Additionally, deploying memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can mitigate the impact of information disclosure by making it more difficult for attackers to predict memory layouts or exploit leaked data effectively. Security teams should also monitor for unusual process behavior or crashes in services that rely on ESE database parsing, particularly when processing files from untrusted sources.