GHSA-9g5r-cg76-29p7MediumCVSS 5.5

[This CNA information record relates to multiple CVEs; the text explains which aspects...

Published
July 28, 2026
Last Modified
July 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-62424 →

📋 Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:

  • The directory loop itself assumes a good record length. This is CVE-2026-42494.

  • The calculation of the System Use area may underflow. This is CVE-2026-42495.

  • The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423.

  • The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424.

  • The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.

🔗 References (3)