CVE-2026-116737 in libphdi
Summary
by MITRE • 10/27/2026
libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability resides within the libphdi library, specifically affecting versions up through 20260902, and is characterized as a heap out-of-bounds read condition. This flaw occurs in the function responsible for retrieving data file paths from Parallels disk image descriptors. The core technical deficiency stems from an incorrect calculation of memory boundaries during string processing operations. Specifically, the implementation erroneously utilizes the length of the directory prefix rather than the actual length of the basename when determining how much heap-allocated buffer space to access or copy. This logical error creates a discrepancy between the allocated memory size and the amount of data being read from that allocation.
When an attacker supplies a crafted Parallels disk image descriptor featuring a long directory prefix combined with a short basename, the application attempts to read beyond the bounds of the intended heap buffer. Because the code relies on the longer directory prefix length for its boundary checks or copy operations, it proceeds to access memory locations that lie outside the allocated region associated with the basename string. This results in an out-of-bounds read operation where sensitive data from adjacent heap allocations is exposed to the application context. Such behavior violates fundamental principles of safe memory management and introduces significant risks regarding information disclosure and system stability.
The operational impact of this vulnerability includes both denial of service and potential unauthorized access to private memory contents. By triggering a crash through malformed input, an attacker can disrupt services relying on libphdi for virtualization tasks involving Parallels disk images. More critically, the exposure of adjacent heap memory may reveal sensitive information such as pointers, cryptographic keys, or other application data stored in nearby allocations. This type of vulnerability aligns with CWE-125, which defines out-of-bounds read errors that allow attackers to leak confidential information from process memory. It also relates to CWE-787, concerning out-of-bounds writes if the flaw were exploitable for write operations, though the current description specifies a read condition.
From an offensive security perspective, this vulnerability can be leveraged in attacks categorized under MITRE ATT&CK technique T1059, specifically command and control or execution phases where memory corruption aids in further exploitation steps like heap spraying or information gathering. The ability to crash processes also supports denial-of-service objectives outlined in techniques such as T1498. Mitigation strategies should prioritize updating libphdi to a patched version that corrects the length calculation logic to strictly use basename lengths for boundary validation. Developers must implement rigorous input validation and bounds checking before performing any memory operations based on string lengths derived from untrusted sources like disk image descriptors. Additionally, employing compiler-based protections such as stack canaries or heap metadata integrity checks can help detect and prevent exploitation attempts in environments where immediate patching is not feasible.