Heap Out-of-Bounds Read Vulnerability in libphdi by Libyal

CVE-2026-116737

What is CVE-2026-116737?

libphdi, an open-source library managed by Libyal, contains a vulnerability that allows a heap out-of-bounds read in the function 'libphdi_data_files_get_extent_data_file_path.' The flaw arises when the library utilizes the directory prefix length instead of the basename length, enabling attackers to craft a malicious Parallels disk image descriptor. By providing a lengthy directory prefix coupled with a short basename, an attacker can potentially crash the application or expose adjacent heap memory, leading to further exploitation opportunities.

References