Description
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libyal | libphdi | ≤ 20260902 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libphdi | No fix yet | — |
| Ubuntu 26.04 LTS | libphdi | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libphdi | 20260902-2.1 | openSUSE-SU-2026:12499-1 |
Advisories 1
- openSUSE-SU-2026:12499-1 libphdi-devel-20260902-2.1 on GA media SUSE / openSUSE Security Updates · Nov 10, 2026
References
- GitHub Issue #6 issue-tracking
- https://github.com/libyal/libphdi product
- https://github.com/libyal/libphdi/commit/61e3e1f6b4c5e15ce827b11858ba51f0dba254e3 patch
- https://github.com/libyal/libphdi/blob/20260902/libphdi/libphdi_data_files.c#L890-L907 technical-description
- https://hackmd.io/@haindpwn/libphdi-extent-data-file-path-heap-oob-read third-party-advisory
- VulnCheck Advisory: libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path third-party-advisory