{"schema":"threatline.record/2","record":{"id":"CVE-2026-116736","aliases":[],"summary":"libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array","details":"Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.","categories":["Unclassified"],"product":"libpff","vendor":"libyal","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116736","source_modified_at":"2026-10-26T21:52:36.380Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"libpff","vendor":"libyal","versions":[{"version":"0","status":"affected","versionType":"custom","lessThanOrEqual":"20260926"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T21:52:36.380Z","modified_at":"2026-10-26T21:52:36.380Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116736","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:52:36.380Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/libyal/libpff/issues/172","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/libyal/libpff","tags":["product"]},{"source":"CVE List","url":"https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266","tags":["patch"]},{"source":"CVE List","url":"https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L8858-L8895","tags":["technical-description"]},{"source":"CVE List","url":"https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-values-array","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T21:52:36.380Z","content_hash":"a7eec8f82de75b12d4b73c0b8917ff2fa375eef1615a4cd001214510356594ab"}}