libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusPublished → DeferredNVD modified 2026-10-27 16:04
- StatusReceived → PublishedNVD modified 2026-10-26 21:52
- First seenCVSS 6.9NVD modified 2026-10-26 22:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/libyal/libphdi
- https://github.com/libyal/libphdi/blob/20260902/libphdi/libphdi_data_files.c#L890-L907
- https://github.com/libyal/libphdi/commit/61e3e1f6b4c5e15ce827b11858ba51f0dba254e3
- https://github.com/libyal/libphdi/issues/6
- https://hackmd.io/@haindpwn/libphdi-extent-data-file-path-heap-oob-read
- https://www.vulncheck.com/advisories/libphdi-through-20260902-heap-out-of-bounds-read-via-extent-data-file-path