Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-123268— libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption

Quick assessment

Affected

libyal libvmdk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 libyal 项目的 libvmdk 组件（截至提交哈希 3fdd7839758e9f44ef95e1dfccde8552b860a4fc）中发现一个安全漏洞。受影响的是文件 libvmdk/libvmdk_extent_table.c 中的函数 libvmdk_extent_table_get_extent_data_file_path，该函数属于“扩展数据文件处理器”组件。对该函数的恶意操纵会导致内存破坏。攻击者可远程发起此类攻击。该漏洞的利用方法已公开披露，可能被实际利用。由于该产品采用滚动发布模型以持续

CVSS 3.5 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption

Source: CVE Program / CVE List V5

Vulnerability Description

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

内存缓冲区边界内操作的限制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libyal	libvmdk	3fdd7839758e9f44ef95e1dfccde8552b860a4fc	`cpe:2.3:a:libyal:libvmdk::::::::`

II. Public POCs for CVE-2026-123268

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123268

请登录查看更多情报信息。

Other References for CVE-2026-123268 (1)

CVE-2026-123268 | libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption (Issue 39) vdb-entry technical-description

Other References for CVE-2026-123268 (7)

https://github.com/user-attachments/files/33394147/01_memory_leak_poc.zip exploit
https://github.com/libyal/libvmdk/issues/39 issue-tracking
https://github.com/libyal/libvmdk/ product
https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b patch
https://vuldb.com/cve/CVE-2026-123268 third-party-advisory
https://vuldb.com/vuln/431574/cti signature permissions-required
https://vuldb.com/submit/1028405 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123268

IV. Related Vulnerabilities

Same product: libvmdk

CVE-2026-123269
libyal libvmdk Descriptor File libvmdk_descriptor_file.c lib

Same vendor: libyal

Same weakness: CWE-119