Directory Management Vulnerability in libfsimage's ISO9660 Driver by Vendor XenProject
CVE-2026-42495

Currently unrated

Key Information:

Vendor: Xen Project
Status: Xen Project
Vendor: CVE Published:; 28 July 2026

🔔 Create Xen Project Vulnerability Alert

What is CVE-2026-42495?

The libfsimage's ISO9660 driver contains vulnerabilities stemming from the mismanagement of lengths derived from attacker-controlled on-disk fields. Notably, the System Use area calculation may underflow, leading to unexpected behaviors. This oversight can potentially be exploited to introduce security risks, allowing for unauthorized data access or system instability.

Affected Version(s)

Xen consult Xen advisory XSA-497

References

https://xenbits.xenproject.org/xsa/advisory-497.html

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 28, 2026
Vulnerability Reserved
Apr 27, 2026

Credit

This issue was discovered by Syed Abdul Khaliq of BugQore.

CVE-2026-42495 Data

JSON