A heap out‑of‑bounds read in libregf_value_item_read_value_data occurs because the function bounds the value data size without subtracting the 4‑byte old‑format cell offset. The flaw, classified as CWE‑125, can be triggered by a specially crafted REGF hive (v1.0 or v1.1) that ends its hive bin at the boundary of the heap block, allowing the library to read memory beyond the intended data region. This can lead to leakage of adjacent heap bytes, potentially exposing sensitive information, or to a crash in consumers such as regfexport and plaso.

The vulnerability affects the libregf library supplied by libyal, with all releases up through 20260526. Applications that embed this library, including the forensic tools regfexport and plaso, are susceptible when parsing malicious REGF hive files.

With a CVSS score of 6.9 the flaw represents a moderate risk, and its EPSS score of less than 1% indicates that exploitation attempts are currently rare. The vulnerability is not listed in CISA KEV. Attackers can exploit the weakness by delivering a crafted REGF hive to any program that uses libregf’s value‑item parsing routine, potentially causing data leakage or a denial‑of‑service crash when the library attempts to read beyond the allocated buffer. No remote code execution, privilege escalation or lateral movement is described by the advisory.