A heap out-of-bounds read vulnerability exists in libphdi through version 20260902 in the function libphdi_data_files_get_extent_data_file_path. The flaw arises because the function uses the directory prefix length instead of the basename length when processing Parallels disk image descriptors. An attacker can craft a descriptor with a long directory prefix and short basename to cause a process crash or potentially expose adjacent heap memory.