{"id":"CVE-2026-123268","kind":"vulnerability","aliases":["CVE-2026-123268"],"related":[],"title":"libvmdk: memory corruption in extent data file path handling","description":"A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.","summary":"libvmdk is a library for reading VMware virtual disk (VMDK) files. A crafted input can corrupt memory in the extent table code that resolves data file paths, and the sources say the attack may be started remotely.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-image-parsing","libvmdk","package","vmdk"],"not_affected_if":["no-vmdk-parsing"],"how_to_check":"- Check whether your software links libvmdk or uses the libvmdk tools (for example, a forensic or disk-image pipeline that reads VMDK files)\n- Compare your libvmdk build against the commit `3fdd7839758e9f44ef95e1dfccde8552b860a4fc` or earlier","fix":"- Apply the patch with identifier `175d3fc0a0b961f362f16e7560a6169d7213e16b` (linked patch on GitHub)\n- No fixed release version is stated; the sources say the project uses a rolling release model","status":"open","published_at":"2026-11-06T01:17:48+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","triaged_at":"2026-11-06T01:19:19+00:00","updated_at":"2026-11-06T01:19:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T01:19:19Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch with identifier `175d3fc0a0b961f362f16e7560a6169d7213e16b` (linked patch on GitHub)\n- No fixed release version is stated; the sources say the project uses a rolling release model","reach":"unknown","title":"libvmdk: memory corruption in extent data file path handling","impact":"high","summary":"libvmdk is a library for reading VMware virtual disk (VMDK) files. A crafted input can corrupt memory in the extent table code that resolves data file paths, and the sources say the attack may be started remotely.","audience":"developers","category":"package","nicknames":[],"who_cares":["libvmdk","vmdk","disk-image-parsing"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"memory corruption that may allow code execution on the parsing host","analyst_note":"Confirm the exploit details and whether the remote trigger requires a specific input path; check the linked patch on GitHub for affected file and version scope.","how_to_check":"- Check whether your software links libvmdk or uses the libvmdk tools (for example, a forensic or disk-image pipeline that reads VMDK files)\n- Compare your libvmdk build against the commit `3fdd7839758e9f44ef95e1dfccde8552b860a4fc` or earlier\n- unknown for exact package versions, since the sources say the project uses a rolling release","plain_action":"","needs_analyst":true,"not_affected_if":["no-vmdk-parsing"],"who_is_affected":"Teams whose software parses VMDK disk images with libvmdk, directly or through a tool that bundles it. The sources describe a remote trigger, but do not say which input paths reach the affected function. Systems that never open VMDK files with libvmdk are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000772,"input_tokens":4402,"output_tokens":663,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123268':12A,15A '-2026':11A,14A '175d3fc0a0b961f362f16e7560a6169d7213e16b':148C '3fdd7839758e9f44ef95e1dfccde8552b860a4fc':71C 'action':155C 'affect':72C,135C 'appli':149C 'attack':55B,102C 'avail':141C 'code':44B 'compon':90C 'continu':126C 'corrupt':3A,38B,100C 'craft':35B 'cve':10A,13A 'data':6A,47B,81C,92C 'deliv':125C 'detect':65C 'disclos':111C 'disk':17B,31B 'disk-image-pars':16B 'exploit':108C 'extent':5A,42B,77C,80C,91C 'file':7A,33B,48B,82C,86C,93C 'fix':157C 'function':75C 'get':79C 'handl':9A 'handler':94C 'identifi':143C 'imag':18B 'inform':133C 'initi':105C 'input':36B 'issu':159C 'lead':97C 'librari':26B 'libvmdk':1A,20B,23B,68C,76C 'libvmdk/libvmdk_extent_table.c':87C 'libyal':67C 'manipul':96C 'may':56B,103C,114C 'memori':2A,39B,99C 'model':123C 'packag':21B 'pars':19B 'patch':146C,151C 'path':8A,49B,83C 'product':118C 'public':112C 'read':28B 'recommend':154C 'releas':122C,138C 'remot':59B,106C 'resolv':46B 'result':130C 'roll':121C 'say':53B 'secur':61C 'sourc':52B 'specif':131C 'start':58B 'tabl':43B,78C 'updat':127C,137C 'use':116C,119C 'version':132C 'virtual':30B 'vmdk':22B,32B 'vmware':29B 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Teams whose software parses VMDK disk images with libvmdk, directly or through a tool that bundles it. The sources describe a remote trigger, but do not say which input paths reach the affected function. Systems that never open VMDK files with libvmdk are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["diskimageparsing","libvmdk","medium","package","vmdk"],"campaign_type":null,"search_a":"'-123268':12A,15A '-2026':11A,14A 'corrupt':3A 'cve':10A,13A 'data':6A 'extent':5A 'file':7A 'handl':9A 'libvmdk':1A 'memori':2A 'path':8A","search_b":"'attack':55B 'code':44B 'corrupt':38B 'craft':35B 'data':47B 'disk':17B,31B 'disk-image-pars':16B 'extent':42B 'file':33B,48B 'imag':18B 'input':36B 'librari':26B 'libvmdk':20B,23B 'may':56B 'memori':39B 'packag':21B 'pars':19B 'path':49B 'read':28B 'remot':59B 'resolv':46B 'say':53B 'sourc':52B 'start':58B 'tabl':43B 'virtual':30B 'vmdk':22B,32B 'vmware':29B","search_c":"'175d3fc0a0b961f362f16e7560a6169d7213e16b':148C '3fdd7839758e9f44ef95e1dfccde8552b860a4fc':71C 'action':155C 'affect':72C,135C 'appli':149C 'attack':102C 'avail':141C 'compon':90C 'continu':126C 'corrupt':100C 'data':81C,92C 'deliv':125C 'detect':65C 'disclos':111C 'exploit':108C 'extent':77C,80C,91C 'file':82C,86C,93C 'fix':157C 'function':75C 'get':79C 'handler':94C 'identifi':143C 'inform':133C 'initi':105C 'issu':159C 'lead':97C 'libvmdk':68C,76C 'libvmdk/libvmdk_extent_table.c':87C 'libyal':67C 'manipul':96C 'may':103C,114C 'memori':99C 'model':123C 'patch':146C,151C 'path':83C 'product':118C 'public':112C 'recommend':154C 'releas':122C,138C 'remot':106C 'result':130C 'roll':121C 'secur':61C 'specif':131C 'tabl':78C 'updat':127C,137C 'use':116C,119C 'version':132C 'vulner':62C","first_public_at":"2026-11-06T01:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123268","severity":null,"published_at":"2026-11-06T01:17:48+00:00","modified_at":"2026-11-06T01:17:48+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","fetched_at":"2026-11-06T01:19:01+00:00","note":null}],"documents":[{"id":82251,"url":"https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}