CVE-2026-111140: Out-of-bounds Read in libyal libregf

The vulnerability in libregf through version 0 involves an out-of-bounds read in the function libregf_value_item_read_value_data(). The issue arises because the code bounds the value data size without subtracting the 4-byte old-format cell offset, leading to reading beyond allocated heap memory. An attacker can exploit this by providing a specially crafted version 1.0 or 1.1 REGF hive file with a value data cell that ends its hive bin, causing leakage of adjacent heap bytes or crashing dependent parsers such as regfexport and plaso.

Successful exploitation can lead to information disclosure by leaking adjacent heap memory or denial of service through crashes in applications that parse REGF hive files using libregf. There is no indication of privilege escalation or remote code execution. The attack requires supplying a crafted REGF hive file and user interaction (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious REGF hive files with libregf or dependent tools to mitigate risk.