Description

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-11-06T01:17:48.573Z",
  "pubdate": "2026-11-06T01:17:48.573Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified within the libvmdk library, specifically affecting the Extent Data File Handler component.\nThe vulnerability resides in the function libvmdk_extent_table_get_extent_data_file_path, which fails to properly validate or handle input data when processing extent files.\nAn attacker can leverage this flaw to trigger memory corruption, potentially leading to arbitrary code execution or a denial-of-service state.\nBecause the vulnerability is exploitable remotely, it poses a significant risk to systems processing untrusted VMDK (Virtual Machine Disk) image files.\nPublic disclosure of the exploit code increases the urgency of remediation, as adversaries may integrate these techniques into automated attack tools.\nThe library utilizes a rolling release model, meaning users must ensure their current build is updated to include the security patch identified by commit 175d3fc0a0b961f362f16e7560a6169d7213e16b.",
  "technicalDetails": "The vulnerability is localized to the libvmdk_extent_table_get_extent_data_file_path function located in libvmdk/libvmdk_extent_table.c. This function is responsible for parsing and resolving file paths defined within the extent table metadata of a VMDK container.\nThe root cause of the vulnerability is a failure in memory management during the retrieval or processing of these file paths. Specifically, the component fails to perform adequate bounds checking or size validation before copying data or allocating memory buffers during path string manipulation.\nExploitation is achieved by providing a crafted VMDK file containing malformed extent data. When the library parses the extent table, it triggers an overflow or improper pointer dereference within the handler. The attacker can manipulate the file content to overflow heap-based buffers, allowing for the corruption of adjacent memory structures. This may overwrite critical objects, function pointers, or return addresses, redirecting the execution flow to attacker-controlled instructions.\nThe attack flow begins when an application linked against libvmdk attempts to open or parse a maliciously formatted VMDK image provided by the attacker. Since libvmdk is often utilized in forensic tools, hypervisors, and virtualization management software, the attack vector is exposed to any process that interacts with external disk images. No authentication is required to initiate the attack, as the exploitation is triggered through the parsing logic of the file itself.\nGiven the nature of memory corruption, the potential post-exploitation impact includes arbitrary code execution with the privileges of the process using libvmdk. If the library is used by high-privilege services or kernel-level components, the impact extends to a full system compromise. If code execution is not achieved, the malformed input will likely result in a crash, leading to a denial-of-service condition for the affected component.\nThis vulnerability affects libvmdk up to the commit 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. The security flaw is mitigated by the patch 175d3fc0a0b961f362f16e7560a6169d7213e16b, which introduces rigorous input validation and safer memory handling practices to prevent overflow conditions during the execution of libvmdk_extent_table_get_extent_data_file_path."
}