CVE-2026-116735
Last modified
CVE-2026-116735 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| libyal | libpff | <= 20260926 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-116735?
How severe is CVE-2026-116735?
How do I fix CVE-2026-116735?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11673Use after free in InterestGroups in Google Chrome prior to 1…8.8
- CVE-2026-116730Furnace through 0.6.8.3 contains an out-of-bounds heap read …5.5
- CVE-2026-116731Furnace through 0.6.8.3 contains an out-of-bounds write vuln…6.1
- CVE-2026-116732libdwarf through 2.3.3 contains a heap out-of-bounds read vu…4.4
- CVE-2026-116733flatcc through 0.6.4 contains an out-of-bounds read vulnerab…3.7
- CVE-2026-116734flatcc through 0.6.4 contains an integer overflow vulnerabil…3.7
- CVE-2026-116736Libpff through 20260926 contains a heap out-of-bounds read v…6.1
- CVE-2026-116737libphdi through 20260902 contains a heap out-of-bounds read …6.1
- CVE-2026-116738VMime through 0.9.2 contains an integer underflow in the uuE…8.8
- CVE-2026-116739VMime through 0.9.2 contains an information disclosure vulne…4.3
- CVE-2026-11674Use after free in Guest View in Google Chrome prior to 149.0…8.8
- CVE-2026-116740libcss through 0.9.2 contains a NULL pointer dereference vul…6.5
Are you affected by CVE-2026-116735?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST