libesedb CVE-2026-111147

Exploitation requires that a victim process an attacker-controlled ESE/EDB database file with esedbexport (or another libesedb consumer) where the multi-value record parsing path reaches libesedb_record_get_multi_value(); the trigger is a crafted, unbounded multi-value offset table. Limiting factors: the CVSS 4.0 vector is AV:L with UI:P, so this is NOT remotely reachable - an attacker must get the malicious file onto a system and have a user or automated job parse it (passive user interaction / file-processing step). There is no authentication-bypass or network service exposure; risk is confined to workflows that parse untrusted ESE/EDB inputs. Impact is bounded to a crash and disclosure of up to about 32 KiB of adjacent heap memory, not code execution.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H, score 6.9 MEDIUM) and the CWE-125 classification agree: this is a local, file-driven out-of-bounds READ, not remote code execution. The dominant impact is availability (VA:H, application crash of esedbexport) with only low confidentiality exposure (VC:L, up to ~32 KiB of adjacent heap). Public exploit code exists (a hackmd write-up and a VulnCheck advisory), which raises practical risk and lowers the barrier to reproduction, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - exploitation is opportunistic/local rather than internet-facing. The key limiting signal is AV:L combined with UI:P (Passive): an attacker cannot reach this remotely; a victim must process an attacker-supplied malicious ESE/EDB database with esedbexport. For most organizations the realistic worst case is a crash or limited heap-memory leak during forensic/offline parsing of untrusted files, which is why the signals converge on MEDIUM rather than HIGH despite the public POC.

An analyst or automated DFIR pipeline runs esedbexport against an ESE/EDB database file that was supplied or planted by an attacker (e.g., pulled from a compromised host or submitted as evidence). The crafted file carries an unbounded multi-value offset table that drives libesedb_record_get_multi_value() to read past buffer bounds, crashing the tool or leaking up to ~32 KiB of adjacent heap memory into output. A public POC/write-up exists, so reliable reproduction is straightforward for an attacker.