{"id":"CVE-2026-123269","kind":"vulnerability","aliases":["CVE-2026-123269"],"related":[],"title":"libvmdk: out-of-bounds read when parsing a crafted descriptor file","description":"A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.","summary":"libvmdk is a library for reading VMware virtual disk (VMDK) files, and its descriptor file header parser can read memory past the end of a buffer. A local attacker who supplies a crafted descriptor file can cause a crash or leak small amounts of memory.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-image-parsing","forensics-tooling","libvmdk","package"],"not_affected_if":["no-libvmdk-dependency","no-untrusted-vmdk-input"],"how_to_check":"- Check whether your project or service depends on libvmdk (for example `dpkg -l | grep -i vmdk` or `rpm -qa | grep -i libvmdk`, or your package manifest).\n- Look for calls to libvmdk_descriptor_file_read_header or any code that opens untrusted VMDK files.","fix":"- Upstream patch referenced by the sources: commit 175d3fc0a0b961f362f16e7560a6169d7213e16b. No fixed release version is stated in the sources.","status":"open","published_at":"2026-11-06T01:17:48+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","triaged_at":"2026-11-06T01:19:22+00:00","updated_at":"2026-11-06T01:19:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T01:19:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upstream patch referenced by the sources: commit 175d3fc0a0b961f362f16e7560a6169d7213e16b. No fixed release version is stated in the sources.","reach":"local","title":"libvmdk: out-of-bounds read when parsing a crafted descriptor file","impact":"low","summary":"libvmdk is a library for reading VMware virtual disk (VMDK) files, and its descriptor file header parser can read memory past the end of a buffer. A local attacker who supplies a crafted descriptor file can cause a crash or leak small amounts of memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["libvmdk","forensics-tooling","disk-image-parsing"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Memory is read out of bounds, causing a crash or small data leak.","analyst_note":"","how_to_check":"- Check whether your project or service depends on libvmdk (for example `dpkg -l | grep -i vmdk` or `rpm -qa | grep -i libvmdk`, or your package manifest).\n- Look for calls to libvmdk_descriptor_file_read_header or any code that opens untrusted VMDK files.","plain_action":"","needs_analyst":false,"not_affected_if":["no-libvmdk-dependency","no-untrusted-vmdk-input"],"who_is_affected":"Only systems that run libvmdk to parse VMDK descriptor files, and mainly those that open files from untrusted sources. The attack needs local access, so a service that only reads disk images you created yourself is at lower risk. Teams that never link against libvmdk can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000737,"input_tokens":4294,"output_tokens":615,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123269':15A,18A '-2026':14A,17A '175d3fc0a0b961f362f16e7560a6169d7213e16b':134C 'affect':80C 'amount':70B 'appli':140C 'attack':56B,112C 'best':137C 'bound':5A,109C 'buffer':53B 'caus':64B 'compon':98C 'craft':10A,60B 'crash':66B 'cve':13A,16A 'descriptor':11A,41B,61B,88C,99C 'detect':76C 'disk':20B,36B 'disk-image-pars':19B 'end':50B 'exploit':121C 'file':12A,38B,42B,62B,89C,94C,100C 'forens':24B 'forensics-tool':23B 'function':86C 'header':43B,91C 'identifi':132C 'imag':21B 'initi':115C 'issu':146C 'leak':68B 'librari':31B 'libvmdk':1A,26B,28B,79C,87C 'libvmdk/libvmdk_descriptor_file.c':95C 'libyal':78C 'local':55B,118C 'manipul':103C 'may':126C 'memori':47B,72B 'must':113C 'out-of-bound':2A,106C 'packag':27B 'pars':8A,22B 'parser':44B,101C 'past':48B 'patch':130C,142C 'posit':119C 'practic':138C 'public':124C 'read':6A,33B,46B,90C,110C 'resolv':144C 'result':104C 'small':69B 'suppli':58B 'tool':25B 'use':128C 'virtual':35B 'vmdk':37B 'vmware':34B 'vulner':74C,83C","nicknames":[],"mitigations":[],"who_affected":"Only systems that run libvmdk to parse VMDK descriptor files, and mainly those that open files from untrusted sources. The attack needs local access, so a service that only reads disk images you created yourself is at lower risk. Teams that never link against libvmdk can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["diskimageparsing","forensicstooling","libvmdk","low","package"],"campaign_type":null,"search_a":"'-123269':15A,18A '-2026':14A,17A 'bound':5A 'craft':10A 'cve':13A,16A 'descriptor':11A 'file':12A 'libvmdk':1A 'out-of-bound':2A 'pars':8A 'read':6A","search_b":"'amount':70B 'attack':56B 'buffer':53B 'caus':64B 'craft':60B 'crash':66B 'descriptor':41B,61B 'disk':20B,36B 'disk-image-pars':19B 'end':50B 'file':38B,42B,62B 'forens':24B 'forensics-tool':23B 'header':43B 'imag':21B 'leak':68B 'librari':31B 'libvmdk':26B,28B 'local':55B 'memori':47B,72B 'packag':27B 'pars':22B 'parser':44B 'past':48B 'read':33B,46B 'small':69B 'suppli':58B 'tool':25B 'virtual':35B 'vmdk':37B 'vmware':34B","search_c":"'175d3fc0a0b961f362f16e7560a6169d7213e16b':134C 'affect':80C 'appli':140C 'attack':112C 'best':137C 'bound':109C 'compon':98C 'descriptor':88C,99C 'detect':76C 'exploit':121C 'file':89C,94C,100C 'function':86C 'header':91C 'identifi':132C 'initi':115C 'issu':146C 'libvmdk':79C,87C 'libvmdk/libvmdk_descriptor_file.c':95C 'libyal':78C 'local':118C 'manipul':103C 'may':126C 'must':113C 'out-of-bound':106C 'parser':101C 'patch':130C,142C 'posit':119C 'practic':138C 'public':124C 'read':90C,110C 'resolv':144C 'result':104C 'use':128C 'vulner':74C,83C","first_public_at":"2026-11-06T01:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123269","severity":null,"published_at":"2026-11-06T01:17:48+00:00","modified_at":"2026-11-06T01:17:48+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","fetched_at":"2026-11-06T01:19:01+00:00","note":null}],"documents":[{"id":82251,"url":"https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}