UBUNTU-CVE-2026-123269: Ubuntu/libvmdk vulnerability
Published Nov 6, 2026
·Updated
A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdkdescriptorfilereadheader of the file libvmdk/libvmdkdescriptorfile.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.
Affected Software
7 affected components
ubuntu/libvmdk*
ubuntu/libvmdk*
ubuntu/libvmdk*
ubuntu/libvmdk*
ubuntu/libvmdk*
ubuntu/libvmdk*
ubuntu/libvmdk*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 175d3fc0a0b961f362f16e7560a6169d7213e16b
Event History
Nov 6, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software