CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpff record entry get multi value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT MV STRING8, PT MV UNICODE or PT MV BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.