CVE-2026-116737 Details
Description
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
A heap out-of-bounds read vulnerability has been identified in libphdi, a library for accessing Parallels Hard Disk image files, in all versions through 20260902. The issue arises in the function 'libphdi_data_files_get_extent_data_file_path' within 'libphdi/libphdi_data_files.c'. The vulnerability is caused by an incorrect calculation of the base filename length when processing a crafted Parallels disk image descriptor. Attackers can exploit this flaw by supplying a malicious disk image descriptor that includes a long directory prefix and a short basename, leading to a crash or the exposure of adjacent heap memory.
The vulnerability has been fixed in the libphdi repository. Users should update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/cve-2026-116737-libphdi-extent-data-file-path-heap-oob-read | CISA-ADP | |
| https://github.com/libyal/libphdi | [email protected] | Vendor |
| https://github.com/libyal/libphdi/blob/20260902/libphdi/libphdi_data_files.c#L890-L907 | [email protected] | Source CodeVendor |
| https://github.com/libyal/libphdi/commit/61e3e1f6b4c5e15ce827b11858ba51f0dba254e3 | [email protected] | Source CodeVendor |
| https://github.com/libyal/libphdi/issues/6 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/libphdi-extent-data-file-path-heap-oob-read | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/libphdi-through-20260902-heap-out-of-bounds-read-via-extent-data-file-path | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libyal libphdi | <= 20260902 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |