Directory Processing Vulnerability in libfsimage's ISO9660 Driver Affects Xen Project
CVE-2026-62425

Currently unrated

Key Information:

Vendor: Xen Project
Status: Xen Project
Vendor: CVE Published:; 28 July 2026

🔔 Create Xen Project Vulnerability Alert

What is CVE-2026-62425?

The libfsimage ISO9660 driver contains a vulnerability where it derives lengths from attacker-controlled on-disk fields without proper validation. This flaw can lead to erroneous assumptions about record lengths in various processing tasks, creating potential security risks. Specifically, the processing of the Rock Ridge NM and CE records does not verify the integrity of entry sizes and offsets, allowing an attacker to exploit these weaknesses. This could result in unexpected behaviors or system compromise.

Affected Version(s)

Xen consult Xen advisory XSA-497

References

https://xenbits.xenproject.org/xsa/advisory-497.html

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 28, 2026
Vulnerability Reserved
Jul 14, 2026

Credit

This issue was discovered by Syed Abdul Khaliq of BugQore.

CVE-2026-62425 Data

JSON