{"id":"CVE-2026-116737","kind":"vulnerability","aliases":["CVE-2026-116737"],"related":[],"title":"libphdi: heap out-of-bounds read lets a crafted disk image leak memory","description":"libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.","summary":"libphdi, a library for reading Parallels disk images, reads past a heap buffer when it builds an extent data file path, because it uses the directory prefix length instead of the basename length. An attacker who supplies a crafted Parallels descriptor can crash the process or expose adjacent heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-image-parsing","libphdi","package","parallels"],"not_affected_if":["no-parallels-images-parsed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:45+00:00","updated_at":"2026-10-26T22:27:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:45Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"libphdi: heap out-of-bounds read lets a crafted disk image leak memory","impact":"medium","summary":"libphdi, a library for reading Parallels disk images, reads past a heap buffer when it builds an extent data file path, because it uses the directory prefix length instead of the basename length. An attacker who supplies a crafted Parallels descriptor can crash the process or expose adjacent heap memory.","category":"package","nicknames":[],"who_cares":["libphdi","parallels","disk-image-parsing"],"confidence":0.6,"needs_auth":"no","worst_case":"process crashes or adjacent heap memory is exposed","analyst_note":"Find the fixed libphdi release and the affected version range; the NVD page is the only source given, so check the upstream project repository for a patch.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-parallels-images-parsed"],"who_is_affected":"Teams that parse Parallels disk images with libphdi, for example through a forensic, conversion or backup tool that opens untrusted .hdd or .hds files. Systems that never open Parallels images with libphdi are not affected. The sources do not list affected or fixed versions beyond 'through 20260902'.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000572,"input_tokens":3327,"output_tokens":479,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116737':17A,20A '-2026':16A,19A '20260902':80C 'adjac':75B,133C 'attack':62B,110C 'basenam':59B,108C,126C 'bound':6A,87C 'buffer':40B 'build':43B 'contain':81C 'craft':10A,66B,114C 'crash':70B,128C 'cve':15A,18A 'data':46B,92C,96C 'descriptor':68B,118C 'directori':53B,102C,122C 'disk':11A,22B,34B,116C 'disk-image-pars':21B 'expos':74B,132C 'extent':45B,95C 'file':47B,93C,97C 'get':94C 'heap':2A,39B,76B,83C,134C 'imag':12A,23B,35B,117C 'instead':56B,105C 'leak':13A 'length':55B,60B,104C,109C 'let':8A 'libphdi':1A,25B,28B,78C,91C 'librari':30B 'long':121C 'memori':14A,77B,135C 'out-of-bound':3A,84C 'packag':26B 'parallel':27B,33B,67B,115C 'pars':24B 'past':37B 'path':48B,98C 'prefix':54B,103C,123C 'process':72B,130C 'read':7A,32B,36B,88C 'short':125C 'suppli':64B,112C 'use':51B,100C 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Teams that parse Parallels disk images with libphdi, for example through a forensic, conversion or backup tool that opens untrusted .hdd or .hds files. Systems that never open Parallels images with libphdi are not affected. The sources do not list affected or fixed versions beyond 'through 20260902'.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116737","severity":null,"published_at":"2026-10-26T22:16:57+00:00","modified_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}