An off‑by‑one bounds check in libpff_table_read_6c_record_entries allows an attacker to trigger a heap out‑of‑bounds read. This vulnerability, mapped to CWE‑193, can expose adjacent heap memory or cause the target application to crash, potentially revealing sensitive data or disrupting service availability.

The flaw resides in the libpff library from the libyal project and affects all releases up to and including 20260926. Any application that imports libpff—such as the command‑line tools pffexport or the Python bindings pypff—may be directly exposed when processing PST, OST, or PAB files.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a crafted PST, OST, or PAB file to an application that uses libpff. If successful, an attacker can read uncontrolled heap memory or cause a crash, potentially leaking confidential information or causing a denial of service. The attack vector is inferred as file‑based, potentially remote if the target application accepts user‑supplied files over a network.