CVE-2026-110598 — Libyal libpff through 20260926: heap out-of-bounds read via libpff_record_entry_get_multi_value

Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value(). Attackers can craft PST, OST, or PAB files with decreasing multi-value offsets to crash libpff, pypff, or pffexport and expose adjacent heap memory.