Read the docs
TI-2026-85712 Aliases CVE-2026-123268GHSA-5hxv-qxwp-44j8

Memory corruption in libyal libvmdk extent data file path handling

Priority LOW 23CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libyal libvmdk up to 3fdd783 is affected by a memory corruption flaw (CWE-119) in the libvmdk_extent_table_get_extent_data_file_path function. A remote attacker with low privileges can trigger it, but the attack requires user interaction. The exploit is publicly disclosed and a public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.

Why it matters now

EPSS 0.00239 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
libyallibvmdk3fdd783—No fix listedCNA
  • libvmdk Vendorlibyal Affected 3fdd783 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:libyal:libvmdk:*:*:*:*:*:*:*:*——libyal
  • cpe:2.3:a:libyal:libvmdk:*:*:*:*:*:*:*:* Versions — — ·libyal

Remediation

The sources list no fixed version for libvmdk. Applying patch 175d3fc is the recommended action.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123268
  2. 2026-11-06 Alias added: GHSA-5hxv-qxwp-44j8

References

Exploit 1

Patch 1

Other 2

  • TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
  • TI-2026-80944 Heap out-of-bounds read in libpff table record parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74943 Heap out-of-bounds read in libewf L01 extended attribute parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74931 Heap out-of-bounds read in libyal libesedb multi-value handling CVSS 4.0MEDIUM 6.9
  • TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74919 libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data CVSS 4.0MEDIUM 6.9
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences