CVE-2026-123269 Details
Description
A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.
A vulnerability allowing for an out-of-bounds read has been identified in libyal libvmdk, specifically within the descriptor file parser component. The issue arises in the function 'libvmdk_descriptor_file_read_header', located in 'libvmdk/libvmdk_descriptor_file.c'. This vulnerability is caused by an integer underflow when the parser processes empty quoted values, such as 'version=""'. The underflow allows the 'value_length' variable to wrap around and be interpreted as a very large number, which could potentially be exploited to read memory out of the intended bounds.
Users are advised to update to the version of libvmdk that includes the patch for this vulnerability. The patched version can be found in the official libvmdk repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libyal/libvmdk/ | [email protected] | Vendor |
| https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b | [email protected] | Source CodeVendor |
| https://github.com/libyal/libvmdk/issues/41 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/user-attachments/files/33394231/03_integer_underflow_poc.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-123269 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1032842 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/431575 | [email protected] | Content Wall |
| https://vuldb.com/vuln/431575/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libyal libvmdk | 20260714 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 6, 2026 | New CVE Received | [email protected] |