CVE-2026-116737: libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path
Published Oct 26, 2026
·Updated
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Affected Software
1 affected component
libyal libphdi<=20260902
Event History
Oct 26, 2026
CVE Published
via MITRE·09:52 PM
Data Sourced
via MITRE·09:52 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and interaction are required for exploitation?
The CVSS vector indicates local attack access and required user interaction. An attacker must cause the target process to handle a crafted Parallels disk image descriptor.
2
What is the practical impact if exploitation succeeds?
Processing the malicious descriptor can crash the affected process, causing denial of service. The out-of-bounds read may also expose adjacent heap memory.