# CVE-2026-116735: libpff off-by-one heap buffer read in table record parsing

Source: https://junglewise.ai/threats/cve-2026-116735-libpff-through-20260926-contains-an-off-by-one-bounds-check-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116735 · Severity: medium · CVSS 6.1 · Published 2026-10-26

libpff is a library for reading Outlook Personal Folder (PST), Offline Folder (OST), and Personal Address Book (PAB) files. An off-by-one error in the table record parsing allows attackers who provide crafted PST, OST, or PAB files to read sensitive data from adjacent heap memory or crash applications like pffexport and pypff that use the library.

Technologies: [Libyal Libpff](https://junglewise.ai/threats/technologies/libpff). Vendors: [Libyal](https://junglewise.ai/threats/vendors/libyal).

## Quick answers

**Is CVE-2026-116735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116735 being exploited in the wild.

**How severe is CVE-2026-116735?** Medium severity, with a CVSS score of 6.1, published 26 October 2026.

**Which products and versions are affected?** Libyal Libpff through 20260926.

**Is there a fix for CVE-2026-116735?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116735 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116735?** Check whether you run Libyal Libpff at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An off-by-one bounds check vulnerability exists in the libpff_table_read_6c_record_entries function when processing 6c table record entries. The vulnerability allows an attacker to craft malicious PST, OST, or PAB files that trigger a heap out-of-bounds read via incorrect bounds validation. This could lead to information disclosure or application crash.

## Affected products

- libyal libpff through 20260926

## Timeline

- 2026-10-26: disclosed

## References

- [https://github.com/libyal/libpff](https://github.com/libyal/libpff)
- [https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c](https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c)

## Related threats

- [Libpff heap out-of-bounds read in table parsing](https://junglewise.ai/threats/cve-2026-116736-libpff-through-20260926-contains-a-heap-out-of-bounds-read)
- [libyal libpff integer underflow in record entry parsing](https://junglewise.ai/threats/cve-2026-110598-libyal-libpff-through-20260926-contains-an-integer-underflow-in)