libphdi EUVD-2026-110485

Exploitation requires that an application or forensic tool embedding libphdi (through version 20260902) open and parse an attacker-controlled Parallels disk image whose descriptor supplies an extent data file path with a long directory prefix and a short basename; this path triggers the miscalculated buffer size in libphdi_data_files_get_extent_data_file_path (and its wide-char counterpart). Limiting factors that reduce realistic risk: the attack vector is local (AV:L), it needs passive user interaction (UI:P) in the form of a victim processing the malicious image, it yields only a crash or limited adjacent-heap disclosure (no write, no code execution, VI:N), and libphdi is a niche DFIR library so the deployed attack surface is narrow.

This is a moderate, defense-grade issue rather than an emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) shows a local attack vector requiring passive user interaction - the victim must open or process an attacker-supplied Parallels disk image - which structurally limits reach compared with a network-facing flaw. The impact split is telling: VC:L (limited adjacent-heap disclosure) and VA:H (process crash) with VI:N, so this is a denial-of-service and partial information-leak bug, not code execution. The exploitation signals reinforce low real-world urgency: EPSS is 0.13% (2nd percentile), there is NO CISA KEV listing, and the vuln.today decision label is 'this_month' (not act_now/emergency). A public PoC reference exists (a hackmd technical write-up and the VulnCheck advisory) but it is not verified as working weaponized exploit code, and PoC availability must not be conflated with active exploitation. There is no conflict among the signals - low EPSS, no KEV, local+UI vector, and a routine patch-this-month priority all point the same direction: a legitimate bug to patch on a normal cycle, not a high-CVSS-but-low-risk mislabel nor an actively exploited crisis. Authentication is unauthenticated per PR:N, though access is local, so 'unauthenticated local processing of a malicious file' is the accurate framing.

An attacker crafts a malicious Parallels disk image whose descriptor specifies an extent data file path with a long directory prefix and a short basename. When a victim's forensic tool or application that embeds libphdi opens and parses this image, the path-building routine uses the directory prefix length instead of the basename length, triggering a heap out-of-bounds read that crashes the process or discloses adjacent heap memory. A public PoC reference exists (hackmd write-up / VulnCheck advisory); it is not verified as working exploit code.