Integer Underflow in libyal libpff via Multi-Value Offsets

Executive Summary

CVE-2026-110598 is a heap out-of-bounds read vulnerability in the libpff library caused by an integer underflow in the multi-value property parser. It occurs when processing MAPI multi-valued string or binary properties in PST or OST files. The parser fails to validate that offsets in the property's offset array are monotonically increasing, allowing attackers to craft malicious files with decreasing offsets. This causes an unsigned integer underflow, leading to a wrapped size of approximately 4 GiB. When an application enumerates such a property, it triggers a heap out-of-bounds read, potentially crashing the application and exposing adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing PST, OST, or PAB files for non-monotonic multi-value offsets. Use tools like libpff's pffinfo or pypff to parse files and check for crashes during processing. Enable AddressSanitizer or similar tools when compiling libpff to catch heap out-of-bounds reads during file parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact users by causing applications like libpff, pypff, or pffexport to crash when processing maliciously crafted PST, OST, or PAB files. The crash may result in denial of service and potential exposure of adjacent heap memory, which could include sensitive data. While no out-of-bounds write or code execution has been established, the risk of information disclosure and service disruption remains a concern for affected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes heap out-of-bounds reads and crashes in applications processing PST, OST, or PAB files. While it does not directly violate GDPR or HIPAA, it could lead to unauthorized data exposure if adjacent heap memory containing sensitive information is accessed during a crash. Denial of service through application crashes may also impact availability requirements in compliance frameworks.

Useful 0 Not Useful 0

Mitigation Strategies

Update libpff to the latest version that includes the monotonicity check for multi-value offsets. Avoid opening untrusted PST, OST, or PAB files until patched. Implement file validation before processing with libpff-based tools to reject malformed files.

Useful 0 Not Useful 0