Live › vulnerability › CVE-2026-116735
Go to dashboardlibpff is a library for reading Outlook PST, OST and PAB files. A crafted file can trigger an off-by-one heap out-of-bounds read in the table record parser, leaking adjacent memory or crashing the program that opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications that open untrusted PST, OST or PAB files with libpff, such as the pffexport tool or the pypff Python binding, are exposed. Systems that only read mail files they created themselves are unlikely to be affected. The sources do not name a fixed version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
This page as .md · .json · in your agent: get_signal("CVE-2026-116735")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.