Catálogo de CVE

CVE-2026-116735

UBUNTU-

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.

Gravedad: Desconocido
Published: Oct 26, 2026, 10:16:00 PM UTC
Updated: Oct 28, 2026, 1:07:37 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.13% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Ubuntu26.10	libpff	`20231205-1build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.04	libpff	`20180714-3.1build2`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.04	libpff	`20231205-1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.04	libpff	`20231205-1build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3.1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3.1build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3build2`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3build3`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu22.04	libpff	`20180714-3`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu22.04	libpff	`20180714-3build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu20.04	libpff	`20180714-1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu20.04	libpff	`20180714-2`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC

Showing 12 observations. All 15 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Ubuntu16.04	libpff	`20120802-5`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu18.04	libpff	`20120802-5`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu18.04	libpff	`20120802-5.1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu20.04	libpff	`20180714-1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu20.04	libpff	`20180714-2`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu22.04	libpff	`20180714-3`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu22.04	libpff	`20180714-3build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3.1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3.1build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3build2`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu24.04	libpff	`20180714-3build3`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.04	libpff	`20180714-3.1build2`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.04	libpff	`20231205-1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.04	libpff	`20231205-1build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC
Ubuntu26.10	libpff	`20231205-1build1`	Affected	[UBUNTU-CVE-2026-116735]Oct 28, 2026, 8:17:45 PM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "20120802-5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    },
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "20120802-5",
        "20120802-5.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    },
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "20180714-1",
        "20180714-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    },
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "20180714-3",
        "20180714-3build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    },
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "20180714-3build2",
        "20180714-3build3",
        "20180714-3.1",
        "20180714-3.1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    },
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "20231205-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    },
    {
      "name": "libpff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "20180714-3.1build2",
        "20231205-1",
        "20231205-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-116735",
      "provider_updated_at": "2026-10-28T20:17:45.938568086Z"
    }
  ]
}

OpenFactory catalog packages

La asociación de paquetes está en curso.

Observado: Oct 28, 2026, 3:09:48 AM UTC

Referencias

[https://osv.dev/vulnerability/UBUNTU-CVE-2026-116735]

[FIRST EPSS] · [OSV Package Vulnerability Database]