CVE-2026-62425 buffer overruns in libfsimage iso9660 handling
MediumCVSS 5.5
EPSS 0.20%
- Published
- Updated
- Exploit status
- No public exploit known
Description
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
-
The directory loop itself assumes a good record length. This is
CVE-2026-42494. -
The calculation of the System Use area may underflow. This is
CVE-2026-42495. -
The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423. -
The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424. -
The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Xen | = consult Xen advisory XSA-497 | No fix listed |
| debian/xen(Debian:12) | < 4.17.7-0+deb12u1 | 4.17.7-0+deb12u1 |
| debian/xen(Debian:12) | = 4.17.1+2-gb773c48e36-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.2+55-g0b56bed864-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.2+76-ge1f9cb16e2-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.2+76-ge1f9cb16e2-1~deb12u1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.2-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.3+10-g091466ba55-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.3+10-g091466ba55-1.1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.3+10-g091466ba55-1.1~exp1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.3+10-g091466ba55-1.1~exp2 | No fix listed |
| debian/xen(Debian:12) | = 4.17.3+10-g091466ba55-1~deb12u1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.3+36-g54dacb5c02-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.5+23-ga4e5191dc0-1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.5+23-ga4e5191dc0-1+deb12u1 | No fix listed |
| debian/xen(Debian:12) | = 4.17.5+72-g01140da4e8-1 | No fix listed |
| debian/xen(Debian:13) | < 4.20.3+127-gc42374a105-0+deb13u1 | 4.20.3+127-gc42374a105-0+deb13u1 |
| debian/xen(Debian:13) | = 4.20.0+68-g35cb38b222-1 | No fix listed |
| debian/xen(Debian:13) | = 4.20.2+37-g61ff35323e-0+deb13u1 | No fix listed |
| debian/xen(Debian:13) | = 4.20.2+37-g61ff35323e-1 | No fix listed |
| debian/xen(Debian:13) | = 4.20.2+7-g1badcf5035-0+deb13u1 | No fix listed |
| debian/xen(Debian:13) | = 4.20.2+7-g1badcf5035-1 | No fix listed |
| debian/xen(Debian:13) | = 4.20.2+7-g1badcf5035-2 | No fix listed |
| debian/xen(Debian:14) | < 4.20.3+127-gc42374a105-1 | 4.20.3+127-gc42374a105-1 |
| debian/xen(Debian:14) | = 4.20.0+68-g35cb38b222-1 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xen(Debian:14) | = 4.20.2+37-g61ff35323e-1 | No fix listed |
| debian/xen(Debian:14) | = 4.20.2+7-g1badcf5035-1 | No fix listed |
| debian/xen(Debian:14) | = 4.20.2+7-g1badcf5035-2 | No fix listed |
| ubuntu/xen(Ubuntu:22.04) | All versions | No fix listed |
| alpine/xen(Alpine:v3.21) | < 4.19.6-r0 | 4.19.6-r0 |
| alpine/xen(Alpine:v3.22) | < 4.20.4-r0 | 4.20.4-r0 |
| alpine/xen(Alpine:v3.23) | < 4.20.4-r0 | 4.20.4-r0 |
| alpine/xen(Alpine:v3.24) | < 4.21.2-r0 | 4.21.2-r0 |
| ubuntu/xen(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/xen(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/xen(Ubuntu:26.10) | All versions | No fix listed |
References
- xenbits.xenproject.org
- Debian Security Tracker CVE-2026-62425 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory