libphdi contains a heap out‑of‑bounds read in the function that determines the extent data file path. The error arises when the library uses the length of the directory prefix instead of the basename, causing an over‑read when a crafted Parallels disk image descriptor file has a long directory component and a short basename. An attacker can supply such a file to trigger the read, which may result in a crash or the exposure of data stored adjacent on the heap, potentially leaking sensitive information.

The affected product is libphdi, developed by libyal. Versions up to and including 20260902 contain the vulnerability. Users who rely on libphdi for reading or processing Parallels disk image descriptors are at risk.

The CVSS score of 6.9 indicates moderate impact, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS data is unavailable, but exploitation would require an attacker to supply a crafted Parallels disk image descriptor file. The attack vector is therefore local or through a supply chain that can introduce malicious descriptor files. Crashing the process is a denial of service, while leaking heap memory can lead to information disclosure. The overall risk to systems that handle untrusted descriptor files is moderate, but still actionable.