CVE-2026-42495 Details
Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
A buffer overrun vulnerability has been identified in the iso9660 driver of libfsimage, present in all Xen versions from 3.2 onwards. This vulnerability arises because the directory and Rock Ridge/SUSP processing loops derive lengths from attacker-controlled on-disk fields without proper validation. Specifically, the issue in CVE-2026-42495 relates to the calculation of the System Use area, which may underflow, potentially leading to arbitrary memory access or corruption.
To address this vulnerability, the attached patch can be applied. For released versions, patches are generally prepared to apply to the stable branches. Downstream users are encouraged to update to the tip of the stable branch before applying these patches. Alternatively, ensuring that guests do not use the pygrub bootloader can avoid this vulnerability. For 64-bit PV guests using grub2, pvgrub is a suitable alternative to pygrub. Running only HVM or PVH guests will also avoid the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://xenbits.xenproject.org/xsa/advisory-497.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 3.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |