{"id":"CVE-2026-116735","kind":"vulnerability","aliases":["CVE-2026-116735"],"related":[],"title":"libpff: off-by-one bounds check lets crafted mail files read heap memory","description":"libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.","summary":"libpff is a library for reading Outlook PST, OST and PAB files. A crafted file can trigger an off-by-one heap out-of-bounds read in the table record parser, leaking adjacent memory or crashing the program that opens it.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["libpff","outlook-files","package","pffexport","pypff"],"not_affected_if":["trusted-files-only"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:47+00:00","updated_at":"2026-10-26T22:27:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:47Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"libpff: off-by-one bounds check lets crafted mail files read heap memory","impact":"low","summary":"libpff is a library for reading Outlook PST, OST and PAB files. A crafted file can trigger an off-by-one heap out-of-bounds read in the table record parser, leaking adjacent memory or crashing the program that opens it.","category":"package","nicknames":[],"who_cares":["libpff","pypff","pffexport","outlook-files"],"confidence":0.6,"needs_auth":"no","worst_case":"heap memory leaks or the parsing process crashes","analyst_note":"Find the fixed libpff release and check the upstream libpff repository or the NVD page for affected version ranges.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["trusted-files-only"],"who_is_affected":"Applications that open untrusted PST, OST or PAB files with libpff, such as the pffexport tool or the pypff Python binding, are exposed. Systems that only read mail files they created themselves are unlikely to be affected. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000548,"input_tokens":3340,"output_tokens":427,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116735':17A,20A '-2026':16A,19A '20260926':72C '6c':85C,102C 'adjac':62B,123C 'allow':89C 'applic':116C 'attack':90C,106C 'bound':6A,54B,79C,98C 'caus':127C 'check':7A,80C 'contain':73C 'craft':9A,41B,101C,109C 'crash':65B,128C 'cve':15A,18A 'entri':87C,105C 'file':11A,24B,39B,42B,114C 'heap':13A,50B,94C,124C 'leak':61B 'let':8A 'libpff':1A,21B,28B,70C,82C 'librari':31B 'like':117C 'mail':10A 'memori':14A,63B,125C 'off-by-on':2A,46B,75C 'one':5A,49B,78C 'open':69B 'ost':36B,111C 'out-of-bound':51B,95C 'outlook':23B,34B 'outlook-fil':22B 'pab':38B,113C 'packag':25B 'parser':60B 'pffexport':26B,118C 'program':67B 'pst':35B,110C 'pypff':27B,120C 'read':12A,33B,55B,84C,99C,122C 'record':59B,86C,104C 'suppli':108C 'tabl':58B,83C,103C 'trigger':44B,92C 'via':100C","nicknames":[],"mitigations":[],"who_affected":"Applications that open untrusted PST, OST or PAB files with libpff, such as the pffexport tool or the pypff Python binding, are exposed. Systems that only read mail files they created themselves are unlikely to be affected. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116735","severity":null,"published_at":"2026-10-26T22:16:57+00:00","modified_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}