CVE-2026-116737

Name of the Vulnerable Software and Affected Versions libphdi versions prior to 20260902

Description A heap out-of-bounds read occurs in the libphdi data files get extent data file path() function. The issue arises because the function utilizes the directory prefix length rather than the basename length. An attacker can exploit this by providing a specially crafted Parallels disk image descriptor featuring a long directory prefix and a short basename, which may lead to a process crash or the exposure of adjacent heap memory.

Recommendations Update libphdi to a version released after 20260902.