Is CVE-2026-111140 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111140 being exploited in the wild.

How severe is CVE-2026-111140?

Medium severity, with a CVSS score of 6.1, published 15 October 2026.

Which products and versions are affected?

Libyal Libregf through 20260526.

Is there a fix for CVE-2026-111140?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111140 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111140?

Check whether you run Libyal Libregf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111140: libregf heap out-of-bounds read in value data parsing

CVE-2026-111140 · Severity: medium · CVSS 6.1 · Published 2026-10-15

libregf is a library that reads Windows Registry files. A flaw in how it parses value data can leak sensitive information from adjacent memory or crash applications like regfexport and plaso when processing specially crafted registry files. An attacker can exploit this by supplying a malicious registry file to cause data exposure or service disruption.

Vendors: Libyal.

Quick answers

Is CVE-2026-111140 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111140 being exploited in the wild.
How severe is CVE-2026-111140?: Medium severity, with a CVSS score of 6.1, published 15 October 2026.
Which products and versions are affected?: Libyal Libregf through 20260526.
Is there a fix for CVE-2026-111140?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111140 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111140?: Check whether you run Libyal Libregf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap out-of-bounds read in libregf_value_item_read_value_data() that fails to account for a 4-byte offset when bounds-checking value data size in version 1.0/1.1 REGF hive files. An attacker-supplied crafted registry hive with a value data cell positioned at the end of a hive bin triggers the out-of-bounds read, allowing heap memory disclosure or denial of service in parsing tools.

Affected products

libyal libregf through 20260526

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.