CVE-2026-116737
libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path
libyal libphdi
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Text from CVE List
Affected versions 1
- libphdiaffected: all versions through 20260902CVE List
References 6
- github.com/libyal/libphdi/commit/61e3e1f6b4c5e15ce827b11858ba51f0dba254e3Fixvia CVE List
- hackmd.io/@haindpwn/libphdi-extent-data-file-path-heap-oob-readAdvisoryvia CVE List
- vulncheck.com/advisories/libphdi-through-20260902-heap-out-of-bounds-read-via-extent-data-file-pathAdvisoryvia CVE List
- github.com/libyal/libphdi/issues/6Referencevia CVE List
- github.com/libyal/libphdiReferencevia CVE List
- github.com/libyal/libphdi/blob/20260902/libphdi/libphdi_data_files.c#L890-L907Referencevia CVE List