CVE-2026-116736 in libpff
Summary
by MITRE • 10/26/2026
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in libpff versions up through 20260926 represents a critical security flaw within the library's handling of Microsoft Outlook data files, specifically affecting the parsing logic for table structures. This issue is located in the function responsible for reading value arrays from PST, OST, or PAB file formats. The core technical deficiency lies in the absence of proper bounds checking when processing column definitions with a type identifier of 0x7c. When the parser encounters such a definition, it attempts to read a specified number of bytes defined by values_array_size into a buffer without verifying that this size does not exceed the remaining available data in the file stream. This lack of validation allows an attacker who controls the input file structure to manipulate the parsing routine into accessing memory locations beyond the intended boundaries of the allocated buffer.
From a technical perspective, this flaw is classified as a heap-based out-of-bounds read vulnerability. The Common Weakness Enumeration (CWE) categorizes this specific type of error under CWE-125: Out-of-bounds Read. In the context of ATT&CK techniques, this vulnerability facilitates information disclosure by allowing an adversary to leak sensitive data stored in adjacent memory regions that were not intended for access during normal file processing operations. The exploitation mechanism relies on crafting a malicious PST, OST, or PAB file where the values_array_size field is set to a value larger than the remaining bytes in the buffer. When libpff processes this crafted input, it reads past the end of the allocated heap memory, potentially retrieving cryptographic keys, session tokens, passwords, or other sensitive information residing in neighboring memory blocks.
The operational impact of this vulnerability extends beyond mere data leakage. While the primary risk is unauthorized access to adjacent heap memory contents, improper handling of such out-of-bounds reads can also lead to application instability. If the read operation accesses unmapped memory pages or triggers segmentation faults due to invalid pointer dereferences in subsequent processing steps, it results in a denial of service condition. This means that applications relying on libpff for parsing email archives or personal address books may crash unexpectedly when presented with maliciously crafted files, disrupting business continuity and potentially causing data loss if unsaved work is involved. The severity is heightened by the fact that these file formats are commonly exchanged between users and processed by various enterprise security tools, including antivirus scanners and forensic analysis software, increasing the attack surface significantly.
Mitigation strategies for this vulnerability require immediate attention from both developers of libpff and end-users relying on it. For library maintainers, the primary remediation involves implementing strict bounds checking within the table reading functions to ensure that values_array_size never exceeds the remaining buffer length before initiating any read operations. This defensive programming practice aligns with secure coding standards such as those outlined in OWASP guidelines for input validation and memory safety. Additionally, integrating fuzzing tools into the continuous integration pipeline can help detect similar boundary condition errors early in the development lifecycle. For end-users and organizations deploying libpff-based solutions, it is crucial to update to a patched version of the library that addresses this specific out-of-bounds read issue. Until an official patch is available, restricting the processing of untrusted PST, OST, or PAB files through sandboxed environments can reduce the risk of successful exploitation by isolating potential memory access violations from critical system resources.