Heap Out-of-Bounds Read in libyal libesedb

Executive Summary

This vulnerability is a heap out-of-bounds read in the libesedb library's libesedb_record_get_multi_value() function. It occurs when parsing multi-valued record properties from ESE/EDB database files. The parser reads the first 16-bit offset without validating if it fits within the buffer size, allowing attackers to craft malicious files that read up to 32 KiB past the end of a heap buffer. This can crash the application or expose adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running libesedb versions up to 20260704. Check for crashes in esedbexport when processing ESE/EDB files with multi-value properties. Use static analysis tools to review libesedb_record_get_multi_value() for missing bounds checks on offset tables.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by providing a specially crafted ESE/EDB database file to the esedbexport tool. This could crash the application processing the file or leak sensitive data from adjacent memory, potentially including credentials or other confidential information stored in memory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. A heap out-of-bounds read may expose up to 32 KiB of adjacent heap memory, which could include sensitive information stored in memory. If exploited, this could lead to data breaches, violating GDPR's data protection principles or HIPAA's confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update libesedb to the latest patched version if available. Avoid processing untrusted ESE/EDB files with esedbexport until patched. Implement input validation for ESE/EDB files to prevent malicious multi-value properties. Monitor for crashes in esedbexport as potential exploitation attempts.

Useful 0 Not Useful 0