UBUNTU-CVE-2026-116737: Medium severity ubuntu/libphdi vulnerability
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must induce processing of a crafted Parallels disk image descriptor. The descriptor needs a long directory prefix and a short basename; user interaction is required according to the CVSS vector.
What is the practical impact of successful exploitation?
Processing the crafted descriptor can cause the affected process to crash, resulting in denial of service. It may also expose adjacent heap memory, causing limited information disclosure.
Which deployments are most exposed?
Deployments that process Parallels disk image descriptors from untrusted or externally supplied sources are exposed. The issue affects libphdi through 20260902.