EUVD-2026-102267Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted REGF hive to analyst
-
ExploitVictim parses hive with libregf tool
-
ExecutionTrigger OOB read in value_data function
-
ImpactLeak adjacent heap bytes or crash parser
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a libregf-based consumer (regfexport, plaso/log2timeline, or any tool linking libregf) parse an attacker-controlled Windows registry hive in the legacy version 1.0/1.1 REGF format, where a value-data cell is crafted to end its hive bin so the unsubtracted 4-byte old-format cell offset pushes the bounded read past the allocation. The key limiting factors are: (1) the attacker cannot trigger it remotely - a victim or automated pipeline must actively open the malicious hive (UI:P/UI:R), (2) only the older 1.0/1.1 hive format reaches the vulnerable path, and (3) impact is confined to reading adjacent heap memory or crashing the process, with no write primitive or code execution indicated. |
| Impact | This is a moderate-severity memory-safety defect (input CVSS 4.0 base 6.9) whose signals point to limited, non-urgent real-world risk. The provided CVSS 4.0 vector is local (AV:L) with low complexity (AC:L), no privileges (PR:N), but passive user interaction (UI:P) - meaning a victim must parse an attacker-supplied REGF hive; it is not remotely triggerable. Impact is split between low confidentiality (VC:L, leaking adjacent heap bytes, consistent with CWE-125 out-of-bounds read) and high availability (VA:H, crashing parsers), with no integrity impact and no code execution claimed. A public POC/write-up exists (VulnCheck advisory plus hackmd technical note), so exploit code is available, but the CVE is NOT in CISA KEV and no EPSS score was provided; absence of KEV plus a local, interaction-dependent vector strongly suggests this is a crash/info-leak primitive used opportunistically in DFIR pipelines rather than a mass-exploited flaw. No signals conflict materially; the main caveat is that EPSS is missing, so exploitation probability cannot be quantified. Bottom line: a genuine bug worth patching in forensic tooling, but not an emergency 'patch-tonight' priority. |
| Exploit ScenarioDerived | An attacker plants or submits a crafted version 1.0/1.1 REGF registry hive (e.g. as evidence pulled into a forensic workflow or an email/file artifact) whose value-data cell is positioned to end its hive bin. When a DFIR analyst or automated pipeline parses it with a libregf-based tool such as regfexport or plaso/log2timeline, libregf_value_item_read_value_data() reads past the allocation, leaking adjacent heap memory into output or crashing the parser. A public technical write-up and VulnCheck advisory demonstrate the condition, so working exploit input is reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap out-of-bounds read in libregf (all snapshots through 20260526) allows an attacker who supplies a crafted legacy Windows registry hive (REGF format version 1.0/1.1) to make a value-data cell appear shorter than it actually is, so the library reads past the end of the cell and either leaks adjacent heap bytes or crashes the process. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious hive; no privileges are required, but user interaction is needed, and the assessed impact is limited to confidentiality loss and denial of service, with no write primitive or code execution indicated. Publicly available exploit code exists in the form of a linked technical writeup, but there is no CISA KEV confirmation of active exploitation; downstream consumers such as regfexport and plaso/log2timeline are affected.
RemediationAI
No vendor-released patch identified at time of analysis: the CVE references point to the vulnerable routine in libregf_value_item.c and to a VulnCheck advisory rather than to a fixed release or commit, so defenders must first inventory every tool that embeds libregf (notably regfexport and plaso/log2timeline) and track libyal/libregf upstream for a corrective commit; when one lands, rebuild and redeploy all consumers, since the library is typically statically linked. Until then, the most effective compensating control is to refuse to parse REGF 1.0/1.1 hives from untrusted sources - the vulnerable path is only reachable with that legacy format, so pre-validating or rejecting old-format hives eliminates the bug, at the cost of breaking legitimate forensic workflows that still need to examine pre-1.2 registry data (those should be routed to an isolated analysis host). Where legacy parsing is unavoidable, run the parsing tool as an unprivileged user inside a disposable container or VM with a hardened/guarded allocator or an ASAN-instrumented build so that a malformed hive aborts the process rather than silently leaking heap contents, and treat any such crash as a potential disclosure event; segregate sensitive data from the parsing process so that leaked adjacent heap bytes have minimal value, and accept that this only reduces, not eliminates, the disclosure risk. Apply the same isolation to automated pipelines that ingest hives from case evidence or third-party submissions, and monitor the libyal project and the VulnCheck advisory page (https://www.vulncheck.com/advisories/libregf-through-20260526-heap-out-of-bounds-read-via-libregf-value-item-read-value-data) for patched versions before restoring full legacy-format processing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows registry hive files are structured as hive bins containing cells; in the legacy 1.0/1.1 hive format, a cell's payload offset is expressed relative to the start of the cell, which includes the 4-byte cell-size field, so a consumer must subtract those 4 bytes when converting the stored offset to an absolute file position. In libregf_value_item_read_value_data() (source lines ~789-935 of libregf/libregf_value_item.c), the value-data size is bounded without performing that 4-byte adjustment, so a value-data cell whose data ends exactly at a hive bin boundary causes the bounded read to run past the intended cell into adjacent heap memory. This is a classic CWE-125 out-of-bounds read: no memory is overwritten (no integrity or availability write primitive), but bytes from the surrounding heap can be disclosed to the caller and the out-of-range access can terminate the parsing process. The affected component is the libyal/libregf library (CPE cpe:2.3:a:libyal:libregf:*:*:*:*:*:*:*:*), which is statically or dynamically linked by hive-parsing tools including regfexport and plaso/log2timeline, so any such consumer that processes attacker-controlled legacy-format hives inherits the defect. The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) matches this reasoning: local/adjacent delivery only, no privileges required, but a victim or automated workflow must open the malformed hive, producing limited information disclosure and a high availability impact when the parser crashes.
Know when Libregf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Attack is local and requires the victim to parse a crafted hive (AV:L/UI:R) with no privileges (PR:N); out-of-bounds read yields limited heap disclosure (C:L) and reliable crashes (A:H), no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB