Libregf
Monthly
Heap out-of-bounds read in libregf (all snapshots through 20260526) allows an attacker who supplies a crafted legacy Windows registry hive (REGF format version 1.0/1.1) to make a value-data cell appear shorter than it actually is, so the library reads past the end of the cell and either leaks adjacent heap bytes or crashes the process. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious hive; no privileges are required, but user interaction is needed, and the assessed impact is limited to confidentiality loss and denial of service, with no write primitive or code execution indicated. Publicly available exploit code exists in the form of a linked technical writeup, but there is no CISA KEV confirmation of active exploitation; downstream consumers such as regfexport and plaso/log2timeline are affected.
Heap out-of-bounds read in libregf (all snapshots through 20260526) allows an attacker who supplies a crafted legacy Windows registry hive (REGF format version 1.0/1.1) to make a value-data cell appear shorter than it actually is, so the library reads past the end of the cell and either leaks adjacent heap bytes or crashes the process. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious hive; no privileges are required, but user interaction is needed, and the assessed impact is limited to confidentiality loss and denial of service, with no write primitive or code execution indicated. Publicly available exploit code exists in the form of a linked technical writeup, but there is no CISA KEV confirmation of active exploitation; downstream consumers such as regfexport and plaso/log2timeline are affected.