CVE-2026-62423 Details
Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
A buffer overrun vulnerability has been identified in the iso9660 driver of libfsimage, present in all Xen versions from 3.2 onwards. This vulnerability arises because the directory and Rock Ridge/System Use area processing loops assume that record lengths derived from on-disk fields are valid, without proper validation. Specifically, the Rock Ridge extension loop and NM record processing can be exploited by providing maliciously crafted ISO images that manipulate record lengths, leading to potential memory corruption.
Applying the patch available in the Xen Security Advisory XSA-497 resolves this vulnerability. For Xen versions that have not yet been released, the patch can be applied to the unstable branch. Additionally, using the pvgrub bootloader instead of pygrub can mitigate the vulnerability for 64-bit PV guests that use grub2.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://xenbits.xenproject.org/xsa/advisory-497.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-130 | Improper Handling of Length Parameter Inconsistency | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 3.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |