CVE-2026-111147: Out-of-bounds Read in libyal libesedb

Libyal libesedb versions through 20260704 contain a heap out-of-bounds read vulnerability in the libesedb_record_get_multi_value() function. This vulnerability arises from unbounded multi-value offset tables, which allow an attacker to read beyond allocated buffers. By providing a specially crafted ESE/EDB database to the esedbexport tool, an attacker can trigger a crash or leak up to about 32 KiB of adjacent heap memory. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no privileges required, user interaction needed, low confidentiality impact, no integrity or availability impact, and no scope or security requirements changes.

An attacker with local access and the ability to supply a crafted ESE/EDB database to esedbexport can cause the application to crash or read approximately 32 KiB of adjacent heap memory. This may lead to information disclosure of sensitive data residing in heap memory. There is no indication of privilege escalation or remote exploitation. The impact is limited to local users who can run the vulnerable tool.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, avoid processing untrusted or suspicious ESE/EDB database files with esedbexport or libesedb. Monitor vendor channels for updates regarding a fix.