CVE-2026-62425

Summary

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:

  • The directory loop itself assumes a good record length. This is CVE-2026-42494.

  • The calculation of the System Use area may underflow. This is CVE-2026-42495.

  • The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423.

  • The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424.

  • The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.

Affected Software

VendorProductVersion RangeStatus
XenXenconsult Xen advisory XSA-497unknown

Weaknesses

Workarounds

XSA-443 added a mechanism to run pygrub de-privileged. Using this mode will mitigate the vulnerability.

Ensuring that guests do not use the pygrub bootloader will avoid this vulnerability.

For cases where the PV guest is known to be 64bit, and uses grub2 as a bootloader, pvgrub is a suitable alternative to pygrub.

Running only HVM or PVH guests will avoid the vulnerability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References