The vulnerability CVE-2026-62423 affects the Rock Ridge extension loop in libfsimage's iso9660 driver. The driver derives several lengths directly from attacker-controlled on-disk fields without proper validation. Specifically, the Rock Ridge extension loop assumes a valid inner record length, which can be manipulated by an attacker. This issue is part of a set of related vulnerabilities affecting directory and Rock Ridge / SUSP processing in libfsimage, each corresponding to different CVEs. CVE-2026-62423 is identified as a moderate severity issue with a CVSS 3.1 vector indicating local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can cause a high impact on availability, potentially leading to denial of service conditions when processing specially crafted iso9660 images with manipulated Rock Ridge extensions. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires local access and user interaction, with low complexity and no privileges needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, avoid processing untrusted iso9660 images with libfsimage to mitigate risk.