CVE-2026-116737
Medium · 6.1CVSS
6.1
EPSS
0.1%
Published
Oct 26, 2026
CISA due date
—
The record
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-57192 Asterisk is an open source private branch exchange and telephony toolkit. CWE-131
- CVE-2026-112710 A heap-based buffer overflow vulnerability exists in the Fireware OS authentication… CWE-131
- CVE-2026-112709 A heap-based buffer overflow vulnerability in the Fireware OS authentication service… CWE-131
- CVE-2026-107590 An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt… CWE-131
- CVE-2026-97631 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”… CWE-131
- CVE-2020-37287 Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect… CWE-131
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-131
- CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a… CWE-131