CVE-2026-123269 libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123269?
CVE-2026-123269 is a medium-severity vulnerability in libyal libvmdk, published on 6 Nov 2026.
Official description
A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.
Which versions are affected by CVE-2026-123269?
How do I fix CVE-2026-123269?
No fix has been published for CVE-2026-123269 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123269 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123269 exists.
Sources
Also known as DEBIAN-CVE-2026-123269, GHSA-327v-6wgx-g787, UBUNTU-CVE-2026-123269.