Vulnerability Spotlight: Power Software PowerISO ISO Code Execution Vulnerabilities
Summary: Cisco Talos disclosed two vulnerabilities, TALOS-2017-0318 and TALOS-2017-0324, in Power Software's PowerISO disk imaging software that may allow an attacker to execute arbitrary code remotely when a specially crafted ISO image is opened and parsed. The flaw lies in parsing the Rock Ridge alternative name (NM) System Use Entry, where a single-byte length field can be manipulated to cause a stack buffer overflow and execute code in the context of the PowerISO user.
What you should know: The attack vector is an ISO file, the same format most software and operating system installation disks ship in, so a user opening a disk image is enough to trigger it. Talos notes Windows 8 and later can mount ISOs natively, which removes the need for the third-party utility in many cases.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026