Description
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libyal libpff
Default version status: unaffected
0 to ≤ 20260926affected
pkg:github/libyal/libpffReferences
- https://github.com/libyal/libpff/issues/172 ↗
- https://github.com/libyal/libpff ↗
- https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266 ↗
- https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L8858-L8895 ↗
- https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads ↗
- https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-values-array ↗