CVE-2026-123268

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.

• CWE-119

• https://github.com/libyal/libvmdk/
• https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b
• https://github.com/libyal/libvmdk/issues/39
• https://github.com/user-attachments/files/33394147/01_memory_leak_poc.zip
• https://vuldb.com/cve/CVE-2026-123268
• https://vuldb.com/submit/1028405
• https://vuldb.com/vuln/431574
• https://vuldb.com/vuln/431574/cti

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12321JIT miscompilation in the JavaScript: WebAssembly component.…5.4
• CVE-2026-12322Clickjacking issue in the Widget: Gtk component. This vulner…5.4
• CVE-2026-12323Spoofing issue in the DOM: Core & HTML component. This vulne…5.4
• CVE-2026-12324Incorrect boundary conditions in the Graphics: CanvasWebGL c…7.3
• CVE-2026-12325Denial-of-service in the Graphics: ImageLib component. This …6.5
• CVE-2026-12326Memory safety bugs present in Firefox 151 and Thunderbird 15…8.1
• CVE-2026-123269A vulnerability was detected in libyal libvmdk. Affected by …3.3
• CVE-2026-12327Memory safety bugs present in Firefox ESR 140.11, Thunderbir…8.1
• CVE-2026-123271ChatCLI before v1.215.2 contains an improper validation vuln…8
• CVE-2026-123272Mark3labs mcp-go before v1.2.1 contains an improper validati…8
• CVE-2026-123273ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infini…6.5
• CVE-2026-123276In JetBrains CLion before 2026.3, 2026.2.4.1 code execution…7.8