Live › vulnerability › CVE-2026-116737
Go to dashboardlibphdi, a library for reading Parallels disk images, reads past a heap buffer when it builds an extent data file path, because it uses the directory prefix length instead of the basename length. An attacker who supplies a crafted Parallels descriptor can crash the process or expose adjacent heap memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Teams that parse Parallels disk images with libphdi, for example through a forensic, conversion or backup tool that opens untrusted .hdd or .hds files. Systems that never open Parallels images with libphdi are not affected. The sources do not list affected or fixed versions beyond 'through 20260902'.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116737")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.