CVE-2026-116736

Name of the Vulnerable Software and Affected Versions Libpff versions prior to 20260927

Description A heap out-of-bounds read occurs in the libpff table read values array() function. This happens because the values array size of a 7c column definition is not validated against the remaining buffer bytes. An attacker can exploit this by providing a specially crafted PST, OST, or PAB file, causing the application to read adjacent heap memory into record entry values or crash.

Recommendations Update Libpff to a version released after 20260926.