A heap out-of-bounds read occurs in libpff_table_read_values_array when a 7c column definition’s values_array_size is not validated against the remaining buffer length. This flaw can cause applications that use libpff to read adjacent memory on the heap, potentially exposing data from other parts of the process or causing a crash. The impact is limited to memory disclosure or denial of service without direct remote code execution.

The vulnerability affects the libyal:libpff library in all releases up to and including 20260926. Applications that parse PST, OST, or PAB files with these libpff versions are at risk.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. Attack vectors are likely local or user-supplied, as an attacker can provide a crafted PST, OST, or PAB file that triggers the read. The vulnerability requires the victim to run an application that loads such a file; no privilege escalation is indicated.