Threat database

CVE-2026-111159 is a heap out-of-bounds read vulnerability in libewf, a component of the libyal project. The flaw exists in the function libewf_lef_extended_attribute_read_data() where UTF-16 name and value sizes are validated incorrectly before doubling, allowing attackers to supply crafted files with oversized extended attribute metadata. This can lead to application crashes or leakage of uninitialized heap memory. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.

CVE-2026-111147 is a heap out-of-bounds read vulnerability in libyal libesedb versions up to 0. It occurs in the function libesedb_record_get_multi_value() due to unbounded multi-value offset tables. An attacker can supply a crafted ESE/EDB database processed by esedbexport to cause a crash or read approximately 32 KiB of adjacent heap memory. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity.

CVE-2026-111140 is a heap out-of-bounds read vulnerability in libyal's libregf library versions up to 0. It occurs in the function libregf_value_item_read_value_data() due to improper bounds checking of value data size without accounting for a 4-byte offset. Crafted REGF hive files of version 1.0 or 1.1 can trigger this flaw, potentially leaking adjacent heap memory or causing crashes in parsers such as regfexport and plaso.

CVE-2026-111135 is a heap out-of-bounds read vulnerability in libfwsi version 0, specifically in the function libfwsi_mtp_volume_values_read_data(). This flaw allows attackers to read beyond buffer boundaries by crafting MTP volume shell items embedded in .lnk files, jump lists, or shell bags. The crafted shell items range from 10 to 53 bytes with an item data size of 44 or more, potentially causing crashes in processes that consume these files. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity.

CVE-2026-111134 is a heap out-of-bounds read vulnerability in libfwsi through version 20260522. It occurs in the function libfwsi_mtp_file_entry_values_read_data() when processing crafted MTP file entry shell items embedded in .lnk files, jump lists, or shell bags. This flaw allows attackers to read memory beyond the intended buffer bounds, potentially causing crashes in applications using libfwsi.

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

CVE-2026-110598 is an integer underflow vulnerability in libyal's libpff library (version 0). It occurs in the function libpff_record_entry_get_multi_value(), allowing crafted PST, OST, or PAB files with non-monotonic multi-value offsets to trigger heap out-of-bounds reads. This can cause crashes in libpff and related tools such as pypff or pffexport and may expose adjacent heap memory.