Skip to main content

libfsimage CVE-2026-62424

| EUVDEUVD-2026-49775 MEDIUM
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-07-28 security@xen.org GHSA-9g5r-cg76-29p7
Information Disclosure Suse
5.5
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access, user interaction required, high availability impact only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 28, 2026 - 16:46 vuln.today
CVE Published
Jul 28, 2026 - 13:19 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:

  • The directory loop itself assumes a good record length. This is

CVE-2026-42494.

  • The calculation of the System Use area may underflow. This is

CVE-2026-42495.

  • The Rock Ridge extension loop assumes a good (inner) record length.

This is CVE-2026-62423.

  • The Rock Ridge NM record processing assumes a good entry length.

This is CVE-2026-62424.

  • The Rock Ridge CE record processing assumes a good size and offset.

This is CVE-2026-62425.

AnalysisAI

Denial of service in libfsimage's iso9660 driver via crafted ISO image with a malformed Rock Ridge NM record entry length, causing crash of tools that use the library. Affects libfsimage from Xen Project; no public exploit or active exploitation identified.

Technical ContextAI

The vulnerability stems from CWE-130 (Improper Handling of Length Parameter Inconsistency) in the Rock Ridge Interchange Protocol (RRIP) implementation within libfsimage. The code processes the NM (Name) record of Rock Ridge extensions without validating the entry length field, which is attacker-controlled via a crafted ISO9660 filesystem. This leads to a denial of service (high availability impact) due to invalid memory access. CPE data is not provided, but the affected component is part of the Xen Project's toolstack, used for booting and file system access in virtualized environments.

Affected ProductsAI

libfsimage, as distributed with Xen (all versions prior to the fix included in Xen Security Advisory XSA-497). The advisory is available at https://xenbits.xenproject.org/xsa/advisory-497.html. Other products embedding libfsimage may also be vulnerable.

RemediationAI

Apply the patch from Xen Security Advisory XSA-497, which validates the entry length in Rock Ridge NM records. As a workaround, avoid mounting or processing untrusted ISO9660 images with any tool relying on libfsimage until the fix is applied. No alternative upstream patch version has been identified, but the advisory provides a direct fix.

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2026-67292 CRITICAL
9.3
CVE-2024-42460 MEDIUM POC
5.3
CVE-2026-54466 CRITICAL
9.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-62424 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy