libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data

Advisories

libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data

Severity: medium
Date: 10/15/2026
Affecting: libregf <= 20260526
CVE: CVE-2026-111140
CWE: CWE-125 Out-of-bounds Read
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind-pwn/libregf-value-data-offset-oob-read
https://github.com/libyal/libregf/blob/1a4bd856484263caa4a5e0d6ba377c3dc69150c7/libregf/libregf_value_item.c#L789-L935
https://github.com/libyal/libregf
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo