Description

A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-11-06T01:17:48.783Z",
  "pubdate": "2026-11-06T01:17:48.783Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability has been identified within the Descriptor File Parser component of libyal libvmdk, specifically residing in the libvmdk_descriptor_file_read_header function.\nThis vulnerability is triggered during the parsing of malformed descriptor files, potentially allowing an attacker to read memory contents beyond the allocated buffer boundaries.\nThe vulnerability requires local access to the system to exploit, meaning an attacker must have the capability to place a crafted VMDK descriptor file on the local file system or induce an application utilizing libvmdk to process a malicious file.\nSuccessful exploitation may lead to information disclosure, where sensitive data residing in adjacent memory regions could be exposed, or cause the application to crash, resulting in a denial-of-service condition.\nGiven that public exploit code is available for this vulnerability, the risk is elevated, necessitating immediate attention.\nUsers and administrators of systems or applications incorporating libvmdk are advised to prioritize the application of the official security patch to remediate this flaw.",
  "technicalDetails": "The vulnerability is situated in the libvmdk_descriptor_file_read_header function located within the libvmdk/libvmdk_descriptor_file.c file. The root cause is an improper bounds check when parsing the contents of a virtual disk descriptor file.\nWhen libvmdk processes the descriptor file header, the parser fails to properly validate the length or structure of input data against the allocated buffer size. Consequently, when the function attempts to read from or process specific fields within the descriptor, it can access memory addresses outside the expected buffer range.\nThe attack flow begins with the provision of a specially crafted VMDK descriptor file containing malicious header data designed to trigger the out-of-bounds condition. An attacker with local access must supply this file to a target application that uses the libvmdk library for parsing operations.\nUpon calling libvmdk_descriptor_file_read_header to process the malicious file, the parser reaches the vulnerable code path. Because the internal logic does not correctly constrain the memory access based on the input size, the library reads data from memory locations beyond the intended buffer. This constitutes an out-of-bounds read.\nThe potential impact of this vulnerability is twofold. Firstly, it poses a significant risk of information leakage; by controlling the conditions of the out-of-bounds read, an attacker may be able to extract sensitive information from the process memory, which could include cryptographic keys, credentials, or other internal application state data. Secondly, depending on the memory layout and the nature of the subsequent processing, the out-of-bounds read may lead to memory corruption that results in an application crash, thereby causing a denial-of-service.\nThe vulnerability is limited to a local attack vector as it necessitates the processing of a file by the victim's local environment. There is no requirement for network interaction, and the vulnerability does not inherently provide for arbitrary code execution, although it facilitates information disclosure and potential service disruption. The issue is addressed by the patch identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b, which introduces robust boundary checking to ensure that all read operations remain within the confines of the allocated memory buffers."
}