---
id: "CVE-2026-123268"
page: "https://infrastack.ai/live/CVE-2026-123268"
kind: "vulnerability"
aliases: ["CVE-2026-123268"]
title: "libvmdk: memory corruption in extent data file path handling"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["disk-image-parsing", "libvmdk", "package", "vmdk"]
not_affected_if: ["no-vmdk-parsing"]
published_at: "2026-11-06T01:17:48+00:00"
first_seen_at: "2026-11-06T01:19:01+00:00"
updated_at: "2026-11-06T01:19:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123268", "first_seen_at": "2026-11-06T01:19:01+00:00"}]
exploit_sources: []
---

# libvmdk: memory corruption in extent data file path handling

Link for people: https://infrastack.ai/live/CVE-2026-123268 (this .md is for agents)

libvmdk is a library for reading VMware virtual disk (VMDK) files. A crafted input can corrupt memory in the extent table code that resolves data file paths, and the sources say the attack may be started remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your software links libvmdk or uses the libvmdk tools (for example, a forensic or disk-image pipeline that reads VMDK files)
- Compare your libvmdk build against the commit `3fdd7839758e9f44ef95e1dfccde8552b860a4fc` or earlier

## Fix

- Apply the patch with identifier `175d3fc0a0b961f362f16e7560a6169d7213e16b` (linked patch on GitHub)
- No fixed release version is stated; the sources say the project uses a rolling release model

## Timeline

- 2026-11-06T01:19:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123268

## Documents

- [fix] Patch: github.com https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b

## From the sources

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_