Buffer overflow in Libyal Libvmdk
CVE-2026-123268
A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Libyal Libvmdk — versions 3fdd7839758e9f44ef95e1dfccde8552b860a4fc
Weakness classification (CWE)
References
- github.com/libyal/libvmdk/ (product)
- github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b (patch)
- github.com/libyal/libvmdk/issues/39 (issue-tracking)
- github.com/user-attachments/files/33394147/01_memory_leak_poc.zip (exploit)
- CVE-2026-123268 | CVE Analysis and Report (third-party-advisory)
- Submit #1028405 | libyal (Joachim Metz) libvmdk `396e1873a030ac535bf919f6707d5be57613ae08` Memory corruption (third-party-advisory)
- VDB-431574 | libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption (technical-description, vdb-entry)
- VDB-431574 | CTI Indicators (IOB, IOC, IOA) (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-123268?
- CVE-2026-123268 is a low-severity vulnerability in Libyal Libvmdk, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 3.5/10. Published 2026-11-06.
- How severe is CVE-2026-123268?
- Low severity. CVSS v3 base score is 3.5 out of 10.