{"id":"CVE-2026-123269","title":"libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds","summary":"A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation re…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-125","CWE-119"],"vendor":"libyal","product":"libvmdk","affected":["libvmdk n/a"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:44:17.214676Z"},"exploitAvailable":true,"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:44:33.655Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123269","references":[{"url":"https://vuldb.com/vuln/431575","label":"VDB-431575 | libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds"},{"url":"https://vuldb.com/vuln/431575/cti","label":"VDB-431575 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-123269","label":"CVE-2026-123269 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1032842","label":"Submit #1032842 | libyal (Joachim Metz) libvmdk 396e1873a030ac535bf919f6707d5be57613ae08` Memory corruption"},{"url":"https://github.com/libyal/libvmdk/issues/41"},{"url":"https://github.com/user-attachments/files/33394231/03_integer_underflow_poc.zip"},{"url":"https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b"},{"url":"https://github.com/libyal/libvmdk/"}],"tags":["cve.org","exploit-available"],"epss":0.00113,"epssPercentile":0.01415,"ingestedAt":"2026-11-06T00:42:24.726Z","slug":"CVE-2026-123269","body":"## Overview\n\nA vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.\n\n## Affected\n\n- `libvmdk n/a`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":30,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":235492,"id":"CVE-2026-123269","ts":1793988051597,"field":"exploit_available","old":"false","new":"true"}]}