CVE-2026-42494: Libfsimage ISO9660 Buffer Overflow Flaw

CVE-2026-42494 Overview

CVE-2026-42494 is an out-of-bounds read vulnerability in the libfsimage iso9660 driver used by the Xen Project hypervisor. The directory walk loop derives its record length directly from attacker-controlled on-disk fields without validating them. A malicious ISO9660 filesystem image can trigger memory access beyond intended bounds when parsed. The flaw is tracked under Xen Project Security Advisory #497 and is classified as [CWE-125] Out-of-bounds Read. This is one of five related issues in the same driver, alongside CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, and CVE-2026-62425.

Critical Impact
A crafted ISO9660 image parsed by libfsimage can cause out-of-bounds reads leading to denial of service of the affected component or information exposure to a local actor.

Affected Products

Xen Project hypervisor components that link against libfsimage
pygrub and related tools that invoke the iso9660 driver in libfsimage
Host toolstacks that parse guest-supplied ISO9660 images

Discovery Timeline

2026-07-28 - CVE-2026-42494 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-42494

Vulnerability Analysis

The vulnerability resides in the iso9660 driver of libfsimage, which performs directory and Rock Ridge / System Use Sharing Protocol (SUSP) walks over on-disk structures. The directory loop consumes a record length field read directly from the ISO9660 image without bounds checking. When the driver iterates through directory records, it uses this untrusted length to advance its parsing pointer. An attacker who controls the image contents can supply a record length that causes the parser to read past the end of the allocated buffer. The result is an out-of-bounds read from adjacent memory within the process performing the parse operation.

Root Cause

The root cause is missing input validation on length fields sourced from attacker-controlled ISO9660 on-disk data. The directory walk assumes the record length is well-formed and within the current sector or block. No sanity check confirms that the length is non-zero, fits within the remaining buffer, or matches the ISO9660 specification bounds. This pattern of trusting on-disk metadata is repeated across the same driver, which is why four sibling CVEs cover related length and offset handling defects.

Attack Vector

Exploitation requires a local actor to supply a malicious ISO9660 image that is subsequently parsed by libfsimage. In Xen deployments, this typically occurs when a guest presents a virtual disk image to a toolstack component such as pygrub. User interaction is required to initiate the parse. Successful triggering causes an out-of-bounds read, which can produce a crash of the parser process or, depending on layout, expose small amounts of adjacent memory. The vector does not permit direct code execution based on the available advisory data.

No verified proof-of-concept code is publicly available. Refer to Xen Project Security Advisory #497 for authoritative technical details.

Detection Methods for CVE-2026-42494

Indicators of Compromise

Unexpected termination or crash of pygrub or other toolstack processes that invoke libfsimage when handling guest ISO images.
Presence of guest-provided ISO9660 images with malformed directory record length fields in host storage paths.
Core dumps or segmentation faults tied to libfsimage iso9660 parsing routines in system logs.

Detection Strategies

Monitor host logs for libfsimage parser crashes and correlate with recent guest disk image changes.
Inspect ISO9660 images offered by guests for directory records whose declared length exceeds the containing sector.
Alert on repeated failures of pygrub invocations tied to a specific guest identifier.

Monitoring Recommendations

Enable verbose logging on toolstack components that call libfsimage and forward events to a centralized log store.
Track process exit codes and abnormal terminations of image-parsing helpers across the Xen host fleet.
Establish a baseline for legitimate ISO handling volume so anomalous parsing bursts stand out.

How to Mitigate CVE-2026-42494

Immediate Actions Required

Apply the patches referenced in Xen Project Security Advisory #497 as soon as they are validated in your environment.
Restrict which principals can supply ISO9660 images to host-side parsers such as pygrub.
Audit guest disk configurations to confirm no untrusted user controls the boot image consumed by the toolstack.

Patch Information

The Xen Project has published fixes through Xen Security Advisory #497. Administrators should track the advisory page for the exact patch commits covering CVE-2026-42494 and the four related CVEs in the same driver, then apply them together to avoid partial coverage.

Workarounds

Disable or avoid using pygrub for guests that can present untrusted ISO9660 images; use direct kernel boot from the host instead.
Confine toolstack image parsing to isolated, unprivileged accounts to limit impact of a successful out-of-bounds read.
Where feasible, mount and pre-validate guest images with a hardened parser before exposing them to libfsimage.

bash

# Example: run pygrub under a dedicated unprivileged user via systemd
# to reduce blast radius when parsing untrusted ISO images.
sudo useradd --system --no-create-home --shell /usr/sbin/nologin xen-parser
sudo chown xen-parser:xen-parser /var/lib/xen/images
# Then configure the toolstack to invoke pygrub as xen-parser and
# apply the Xen Project patches from XSA-497 as soon as available.