CVE-2026-116735
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap o
CVSS
6.1
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 26, 2026 · Last modified: Oct 26, 2026 · CWE-193
Not enough EPSS history yet.
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes.
- github.comhttps://github.com/libyal/libpff
- github.comhttps://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L5431-L5445
- github.comhttps://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266
- github.comhttps://github.com/libyal/libpff/issues/172
- hackmd.iohttps://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-6c-record-entries
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1159166.5 MED—
———vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.8hCVE-2026-1144605.3 MED19.7%
——6A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.5dCVE-2026-127274.3 MED12.5%
——4IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.3dCVE-2026-1112736.1 MED11.0%
——3unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.10dCVE-2026-1084438.8 HIG49.3%
——15Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.7dCVE-2026-1013026.5 MED14.9%
——4TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.
A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).7d