Libyal

12 CVEs in 9 Libyal products, including Libpff, Libfwsi, Libesedb. Newest: CVE-2026-116743 (2026-10-26). Severity, EPSS and public exploits for each.

Libyal products with known CVEs

ProductCVEs
Libpff3
Libfwsi2
Libesedb1
Libewf1
Libfsapfs1
Libfvde1
Libmsiecf1
Libphdi1
Libregf1
Libyal CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-116743Medium5.52026-10-26libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via cra…
CVE-2026-116737Medium6.12026-10-26libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length…
CVE-2026-116736Medium6.12026-10-26Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size i…
CVE-2026-116735Medium6.12026-10-26libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read v…
CVE-2026-116728Medium5.52026-10-26libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not c…
CVE-2026-111159Medium6.12026-10-15libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are v…
CVE-2026-111147Medium6.12026-10-15Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffe…
CVE-2026-111140Medium6.12026-10-15libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4…
CVE-2026-111135Medium6.12026-10-15libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bo…
CVE-2026-111134Medium6.12026-10-15libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffe…
CVE-2026-111133Medium6.12026-10-15libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads v…
CVE-2026-110598Medium6.12026-10-14Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads…