Libphdi
Monthly
Heap out-of-bounds read in libphdi (all versions through the 20260902 snapshot) lets a crafted Parallels disk image descriptor crash any application that parses it, or expose a limited amount of adjacent heap memory. The bug sits in libphdi_data_files_get_extent_data_file_path and its wide-character twin: the extent data file name length is computed from the directory prefix length rather than the remaining basename length, so a long directory prefix paired with a short basename yields an over-long size and later reads walk past the heap allocation. The vector is local with a passive user-interaction step (the victim must open or process the malicious image), unauthenticated per the PR:N vector, with no write primitive and no code execution; EPSS is 0.13% (2nd percentile), the issue is not in CISA KEV, and no public exploit was identified at time of analysis though a public technical write-up has been published and an upstream fix commit exists.
Heap out-of-bounds read in libphdi (all versions through the 20260902 snapshot) lets a crafted Parallels disk image descriptor crash any application that parses it, or expose a limited amount of adjacent heap memory. The bug sits in libphdi_data_files_get_extent_data_file_path and its wide-character twin: the extent data file name length is computed from the directory prefix length rather than the remaining basename length, so a long directory prefix paired with a short basename yields an over-long size and later reads walk past the heap allocation. The vector is local with a passive user-interaction step (the victim must open or process the malicious image), unauthenticated per the PR:N vector, with no write primitive and no code execution; EPSS is 0.13% (2nd percentile), the issue is not in CISA KEV, and no public exploit was identified at time of analysis though a public technical write-up has been published and an upstream fix commit exists.