---
id: "CVE-2026-116735"
kind: "vulnerability"
aliases: ["CVE-2026-116735"]
title: "libpff: off-by-one bounds check lets crafted mail files read heap memory"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["libpff", "outlook-files", "package", "pffexport", "pypff"]
not_affected_if: ["trusted-files-only"]
published_at: "2026-10-26T22:16:57+00:00"
first_seen_at: "2026-10-26T22:25:34+00:00"
updated_at: "2026-10-26T22:27:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116735", "first_seen_at": "2026-10-26T22:25:34+00:00"}]
---

# libpff: off-by-one bounds check lets crafted mail files read heap memory

libpff is a library for reading Outlook PST, OST and PAB files. A crafted file can trigger an off-by-one heap out-of-bounds read in the table record parser, leaking adjacent memory or crashing the program that opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T22:25:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116735

## From the sources

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_