libpff CVE-2026-116736

Exploitation requires a victim to open or parse an attacker-crafted PST, OST or PAB file using an application linked against libpff version 0 through 20260926. The specific trigger is a 7c-type table column definition whose values_array_size field is larger than the remaining values-array buffer bytes (values_array_entry_size minus values_array_offset), which prior code did not validate before reading. Limiting factors: this is a local attack vector (AV:L) requiring user interaction (UI:P) - the attacker must get the malicious file processed; there is no network-service exposure and no privilege requirement. No special non-default configuration is needed beyond the application actually parsing table values from an untrusted mail-store file. Impact is bounded to limited heap information disclosure (adjacent memory read into record entry values) and availability loss (crash), with no integrity impact.

This is a moderate-severity, low-urgency issue whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) correctly describes a local file-parsing bug: exploitation requires a victim to process an attacker-supplied PST, OST or PAB file (UI:P) with a vulnerable libpff build, not a network-reachable service, so despite PR:N (no authentication needed) it is not a remotely triggerable flaw. EPSS is very low (0.13%, 2nd percentile) and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - consistent with a niche forensic/email-parsing library rather than a mass-exploited target. The vuln.today decision label is 'this_month' (not act_now/emergency), matching the picture of a real but non-urgent bug. A public write-up reference exists (hackmd) alongside a GitHub issue, so some technical detail is public, but no SSVC automatable/technical-impact block was supplied in the input. Net assessment: a genuine memory-safety defect worth patching on a normal cycle, not a high-priority emergency; the primary real-world impact is a crash (VA:H) or limited heap-memory disclosure (VC:L) in tools that ingest untrusted mail-store files.

An attacker crafts a malicious PST/OST/PAB file with a 7c-type table column definition whose values_array_size exceeds the remaining buffer, then delivers it to a victim (e.g., as an email export handed to a DFIR analyst or submitted to an automated forensic/ingestion pipeline). When an application built on libpff ≤20260926 parses the file via libpff_table_read_values_array, it reads adjacent heap memory into record-entry values or crashes. A public PoC reference exists (a hackmd write-up and GitHub issue); it is not verified as working exploit code.