Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-123269— libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds

Quick assessment

Affected

libyal libvmdk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 libyal 项目的 libvmdk 组件中发现一处漏洞。该漏洞影响位于 libvmdk/libvmdk_descriptor_file.c 文件中的 libvmdk_descriptor_file_read_header 函数，属于描述文件解析器（Descriptor File Parser）组件。攻击者通过恶意操作可触发越界读取漏洞。该攻击必须从本地发起。目前利用代码已公开，可被实际利用。修复该问题的补丁提交哈希为 175d3fc0a0b961f362f16e7560a6169d7213e16b。建议尽快应

CVSS 3.3 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libyal	libvmdk	n/a	`cpe:2.3:a:libyal:libvmdk::::::::`

II. Public POCs for CVE-2026-123269

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123269

请登录查看更多情报信息。

Other References for CVE-2026-123269 (1)

CVE-2026-123269 | libyal libvmdk Descriptor File Parser libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds (Issue 41) vdb-entry technical-description

Other References for CVE-2026-123269 (7)

https://github.com/libyal/libvmdk/issues/41 issue-tracking
https://github.com/libyal/libvmdk/ product
https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b patch
https://github.com/user-attachments/files/33394231/03_integer_underflow_poc.zip exploit
https://vuldb.com/cve/CVE-2026-123269 third-party-advisory
https://vuldb.com/vuln/431575/cti signature permissions-required
https://vuldb.com/submit/1032842 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123269

IV. Related Vulnerabilities

Same product: libvmdk

CVE-2026-123268
libyal libvmdk Extent Data File libvmdk_extent_table.c libvm

Same vendor: libyal

Same weakness: CWE-125