CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-42494: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsi

mediumCVSS 6.1CVE-2026-42494
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: - The directory loop itself assumes a good record length. This is CVE-2026-42494. - The calculation of the System Use area may underflow. This is CVE-2026-42495. - The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. - The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. - The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.

Details

Source
NVD Recent CVEs (US · database · site)
Severity
medium — CVSS 6.1
Published
2026-07-28
Last updated
2026-07-28
Exploitation
Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-42494

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-42494coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for [This CNA information

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from NVD Recent CVEs