Skip to main content

Suse CVE-2026-62423

| EUVDEUVD-2026-49774 MEDIUM
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-07-28 security@xen.org GHSA-wgq7-83qv-q9cw
Information Disclosure Suse
5.5
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
8.1 HIGH
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 28, 2026 - 16:47 vuln.today
CVE Published
Jul 28, 2026 - 13:19 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:

  • The directory loop itself assumes a good record length. This is

CVE-2026-42494.

  • The calculation of the System Use area may underflow. This is

CVE-2026-42495.

  • The Rock Ridge extension loop assumes a good (inner) record length.

This is CVE-2026-62423.

  • The Rock Ridge NM record processing assumes a good entry length.

This is CVE-2026-62424.

  • The Rock Ridge CE record processing assumes a good size and offset.

This is CVE-2026-62425.

AnalysisAI

Denial of service in the iso9660 driver of libfsimage when parsing Rock Ridge extensions. The vulnerability affects the Xen hypervisor's toolstack and potentially other software using this library. A crafted ISO image can trigger an infinite loop or memory corruption due to failure to validate record lengths, resulting in a crash. This issue is not known to be exploited publicly and requires local user interaction.

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2026-67292 CRITICAL
9.3
CVE-2024-42460 MEDIUM POC
5.3
CVE-2026-54466 CRITICAL
9.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-62423 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy