CVE-2026-42494
Received Received - Intake

Buffer Overflow in libfsimage ISO9660 Driver

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-42494
EUVD
EUVD-2026-49772

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen From 3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability, CVE-2026-42494, exists in the libfsimage library's iso9660 driver. It involves a directory loop that assumes a valid record length without checking attacker-controlled on-disk fields. This can lead to improper handling of maliciously crafted ISO files.

Detection Guidance

This vulnerability involves improper handling of ISO9660 filesystem driver fields in libfsimage. Detection requires examining filesystem parsing logic for unvalidated record lengths. No direct commands are provided for detection as this is a library-level issue typically exposed through application usage.

Impact Analysis

An attacker could exploit this to cause a denial of service or potentially execute arbitrary code by tricking a user into processing a specially crafted ISO file. This affects systems using the vulnerable library for ISO file handling.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it relates to privilege escalation in the Xen hypervisor's ISO9660 filesystem handling. Compliance impacts would depend on system configuration and data exposure rather than the vulnerability itself.

Mitigation Strategies

Apply patches from Xen.org addressing the libfsimage ISO9660 driver vulnerabilities. Update affected systems to versions containing fixes for CVE-2026-42494 and related CVEs. Monitor vendor advisories for libfsimage updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart