libpff EUVD-2026-110483

Exploitation requires an attacker-supplied, specially crafted PST, OST, or PAB file to be parsed by an application built on libpff (explicitly pffexport or pypff); the flaw is reached through the 6c table record-entry parsing path (libpff_table_read_6c_record_entries). Per the CVSS vector it is a local vector (AV:L) with passive user interaction (UI:P) and no authentication (PR:N) - meaning a user or automated pipeline must open/process the malicious file for the bug to trigger. Limiting factors: there is no remote network trigger, no privilege escalation or write primitive, and impact is confined to reading adjacent heap memory (low confidentiality) or crashing the parser (availability); no special non-default configuration is required beyond using an affected libpff version (through 20260926) to process the hostile file.

This is a moderate, not emergency, priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) describes a locally-triggered, low-complexity flaw with no privileges but requiring passive user interaction - i.e. a victim must open or process an attacker-supplied file. Impact is bounded: VC:L (a heap out-of-bounds READ exposing adjacent memory) and VA:H (crash/denial of the parsing process), with no integrity impact (VI:N) and no code execution. The signals are consistent and point to low real-world urgency: EPSS is 0.13% (2nd percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' - meaning patch on a normal cycle, not immediately. The CWE-193 off-by-one classification is directly corroborated by the vendor source diff, which changes the bounds check in libpff_table_read_6c_record_entries from '(16 * values_array_number) > table_values_array_data_size' to 'values_array_number >= (table_values_array_data_size / 16)', confirming the mechanism is an arithmetic bounds-check error, not a write primitive. The 'Buffer Overflow' tag overstates this: it is an out-of-bounds read, so the practical risk is information disclosure of adjacent heap bytes and process crashes, not memory corruption leading to RCE. Net: a legitimate but low-to-moderate issue, appropriately rated ~6.9, driven mostly by the availability (crash) impact.

An attacker crafts a malicious PST, OST, or PAB file with a malformed 6c table record entry and delivers it to a victim (for example, an analyst or an automated forensics/ingestion pipeline). When the file is processed by a libpff-based tool such as pffexport or a pypff script, the off-by-one bounds check is bypassed and the parser reads past the end of the values-array buffer, leaking adjacent heap memory into output or crashing the process. A public technical write-up (hackmd) and a VulnCheck advisory describe the flaw; these are analysis references and are not verified as working weaponized exploit code.