CVE-2026-123268 Details
Description
A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.
A memory corruption vulnerability has been identified in libyal libvmdk versions prior to the commit 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. The issue arises in the function 'libvmdk_extent_table_get_extent_data_file_path' within 'libvmdk/libvmdk_extent_table.c', specifically in the Extent Data File Handler component. This vulnerability can be exploited remotely, leading to memory corruption.
Users are advised to update to the latest version of libyal libvmdk, as the vulnerability has been fixed in the commit 175d3fc0a0b961f362f16e7560a6169d7213e16b.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libyal/libvmdk/ | [email protected] | Vendor |
| https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b | [email protected] | Source CodeVendor |
| https://github.com/libyal/libvmdk/issues/39 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/user-attachments/files/33394147/01_memory_leak_poc.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-123268 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1028405 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/431574 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431574/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libyal libvmdk | <= 3fdd7839758e9f44ef95e1dfccde8552b860a4fc |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |