CVE-2026-123269

A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.

• CWE-119
• CWE-125

• https://github.com/libyal/libvmdk/
• https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b
• https://github.com/libyal/libvmdk/issues/41
• https://github.com/user-attachments/files/33394231/03_integer_underflow_poc.zip
• https://vuldb.com/cve/CVE-2026-123269
• https://vuldb.com/submit/1032842
• https://vuldb.com/vuln/431575
• https://vuldb.com/vuln/431575/cti

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12322Clickjacking issue in the Widget: Gtk component. This vulner…5.4
• CVE-2026-12323Spoofing issue in the DOM: Core & HTML component. This vulne…5.4
• CVE-2026-12324Incorrect boundary conditions in the Graphics: CanvasWebGL c…7.3
• CVE-2026-12325Denial-of-service in the Graphics: ImageLib component. This …6.5
• CVE-2026-12326Memory safety bugs present in Firefox 151 and Thunderbird 15…8.1
• CVE-2026-123268A security vulnerability has been detected in libyal libvmdk…3.5
• CVE-2026-12327Memory safety bugs present in Firefox ESR 140.11, Thunderbir…8.1
• CVE-2026-123271ChatCLI before v1.215.2 contains an improper validation vuln…8
• CVE-2026-123272Mark3labs mcp-go before v1.2.1 contains an improper validati…8
• CVE-2026-123273ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infini…6.5
• CVE-2026-123276In JetBrains CLion before 2026.3, 2026.2.4.1 code execution…7.8
• CVE-2026-123277In JetBrains CLion before 2026.3, 2026.2.4.1 missing authen…5