An integer underflow occurs in libpff_record_entry_get_multi_value() leading to heap out‑of‑bounds reads when processing non‑monotonic multi‑value offsets. Attackers can craft PST, OST, or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE, or PT_MV_BINARY offsets, causing libpff, pypff, or pffexport to read memory beyond the intended buffer. This can crash the application or expose adjacent heap data, potentially revealing sensitive information such as credentials, encryption keys, or other hidden data.

The weakness affects the libyal libpff library in versions up to and including 20260926. Any software that uses libpff—such as pypff, pffexport, or other forensic tools that parse PST, OST, or PAB files—could be vulnerable. Users who integrate libpff into custom applications or services are also impacted.

The CVSS v3.1 score of 6.9 indicates a moderate severity. The EPSS score of 0.00171 suggests a very low likelihood of exploitation, but the lack of a KEV listing indicates no known active exploitation. The primary attack vector is inferred to be local or remote file processing, as the vulnerability requires a specially crafted PST/OST/PAB file to be parsed by a vulnerable application. If successful, the attacker could trigger a crash or read adjacent heap memory, potentially leaking sensitive data, though no remote code execution is supported by the current description.