An integer underflow occurs in libpff_record_entry_get_multi_value() leading to heap out‑of‑bounds reads when processing non‑monotonic multi‑value offsets. Attackers can craft PST, OST, or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE, or PT_MV_BINARY offsets, causing libpff, pypff, or pffexport to read memory beyond the intended buffer. This can crash the application or expose adjacent heap data, potentially revealing sensitive information such as credentials, encryption keys, or other hidden data.

The weakness affects the libyal libpff library in versions up to and including 20260926. Any software that uses libpff—such as pypff, pffexport, or other forensic tools that parse PST, OST, or PAB files—could be vulnerable. Users who integrate libpff into custom applications or services are also impacted.

The CVSS v3.1 score of 6.9 indicates a moderate severity. The EPSS score is unavailable, so the likelihood of exploitation is unknown, but lack of KEV listing suggests no known active exploitation. The primary attack vector is local or remote file processing; an attacker must supply a specially crafted PST/OST/PAB file to a vulnerable application. If successful, the attacker could trigger a crash or read adjacent heap memory, potentially leaking sensitive data, though no remote code execution is supported by the current description.