Dislocker CVE-2026-107635

Exploitation requires an attacker to supply a crafted BitLocker volume image in which a VMK or FVEK datum sets datum_size to a value that passes get_header_safe()'s minimal 8-byte check but is smaller than the type-specific AES-CCM header (36 bytes), so the unchecked subtraction in get_vmk()/get_fvek() underflows. Limiting factors that reduce real-world risk: the attack is local (AV:L) - there is no remote or automatic trigger - and it requires user interaction, namely a victim actively running dislocker against the malicious image. No special non-default configuration is needed beyond normal use of dislocker to read/decrypt the attacker-controlled volume, and the impact is confined to crashing the dislocker process (availability only).

This is a memory-safety defect whose real-world risk is modest despite a CVSS 4.0 base score of 6.8 (medium). The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) makes the limited impact explicit: the only consequence is availability (VA:H) - an out-of-bounds heap READ that crashes the dislocker process - with no confidentiality (VC:N) or integrity (VI:N) impact, i.e. this is a denial-of-service/crash bug, not code execution or key disclosure. The attack vector is Local (AV:L), not network, and requires passive user interaction (UI:P): a victim must run dislocker against an attacker-supplied BitLocker volume image. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so exploitation-probability signals are absent rather than conflicting. With no CISA KEV entry and no exploit code referenced, there is no public exploit identified at time of analysis. Net assessment: a legitimately-scored but lower-priority issue - a crash-only DoS in a niche forensic tool that an attacker can only trigger by getting a user to process a malicious image. A vendor patch is available, so remediation is simply upgrading past 0.7.3.

An attacker crafts a malicious BitLocker volume image whose VMK or FVEK datum declares a datum_size smaller than the 36-byte AES-CCM header, then induces a victim - for example a forensic analyst inspecting an untrusted disk image - to open it with dislocker. The undersized datum_size causes an integer underflow when the header size is subtracted, producing a ~4GB length that drives hexdump() to over-read heap memory and crash the process. No public exploit code is referenced in the input, so exploitation is currently theoretical/POC-absent and limited to a local crash.