A memory corruption flaw exists in the libvmdk component of the libyal project, specifically in the libvmdk_extent_table_get_extent_data_file_path function. The vulnerability arises when malicious input is processed by this function, leading to uncontrolled memory corruption that could allow an attacker to compromise the integrity of the system. The flaw is identified as CWE-119, indicating a buffer handling issue.

The affected product is libyal's libvmdk library, distributed under a rolling release model. No specific version numbers are listed, but all revisions prior to the commit 175d3fc0a0b961f362f16e7560a6169d7213e16b contain the vulnerable code. Users on any deployment of libvmdk that has not yet received the latest patch may be affected.

The CVSS score for this vulnerability is 5.1, reflecting a moderate impact. The EPSS score is not available, making it unclear how frequently this issue is being exploited in the wild. It is not present in the CISA KEV catalog. The attack can potentially be initiated remotely, as the flaw occurs in a library that may be invoked over network interfaces. While no exploitation proof is presented in the official description, the existence of multiple public proofs of concept suggests that the vulnerability could be leveraged by attackers. The recommended response is therefore to apply the vendor-supplied patch promptly.