EUVD-2026-110476
GHSA-7qjq-mq3w-jp59
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted FileVault 2 Core Storage volume
-
ExploitVictim tool calls libfvde_volume_open()
-
ExecutionUnchecked xml_plist_data_size drives heap out-of-bounds read
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to supply a crafted FileVault 2 Core Storage volume that is then opened by software using libfvde (through 20260923) via libfvde_volume_open(); the specific trigger is a malicious xml_plist_data_size field in the type 0x0024 encrypted-metadata record that is not validated against the source metadata block size (block_data_size - 16). Limiting factors: the vector is local (AV:L) with no network exposure, and it requires passive user interaction (UI:P) - a user or automated job must choose to open the attacker-controlled volume image. No special product configuration or authentication is needed, but the impact is confined to a crash of the parsing process (VA:H only); there is no confidentiality or integrity impact. |
| Impact | This is a medium-severity denial-of-service issue, not a code-execution or data-exposure flaw. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and is availability-only: the description confirms the sole outcome is a crash of the application consuming the volume, with no confidentiality (VC:N) or integrity (VI:N) impact. The signals are internally consistent and all point to low real-world urgency: EPSS is 0.14% (3rd percentile), the vulnerability is NOT on the CISA KEV list (no confirmed active exploitation), and the vuln.today decision label is 'this_month' rather than act_now/emergency. AV:L plus UI:P means an attacker cannot reach this remotely - a local user or automated tool must be induced to open an attacker-crafted FileVault 2 Core Storage volume. Note the 'Information Disclosure' tag conflicts with the evidence: CVSS sets VC:N and the description describes only a crash, so treat the practical impact as DoS, not data leakage. Overall this is a genuine but low-priority bug most relevant to forensic/DFIR workflows and automated pipelines that parse untrusted disk images; it is not a high-CVSS-but-overhyped emergency, nor is it a sleeper - the EPSS, KEV, and local-only vector agree it is low risk. |
| Exploit ScenarioDerived | An analyst or an automated DFIR pipeline opens a FileVault 2 Core Storage volume image obtained from an untrusted source using software built on libfvde. During libfvde_volume_open(), the unchecked xml_plist_data_size in libfvde_encrypted_metadata_read_type_0x0024() causes a read past the heap block buffer, crashing the process. A public PoC reference exists (a hackmd write-up and GitHub issue #70); it is not verified as working exploit code, and the attack is local and requires the victim to open the malicious volume (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Heap out-of-bounds read in libfvde through 20260923 can crash any application that opens a crafted FileVault 2 Core Storage volume via libfvde_volume_open(). The type 0x0024 encrypted-metadata parser uses an xml_plist_data_size value without checking it against the source metadata block, so a malicious volume image causes a read past the heap buffer and terminates the parsing process, with availability impact only and no confidentiality or integrity impact. The CVSS 4.0 vector is local (AV:L) with no privileges required (PR:N) and passive user interaction (UI:P); EPSS is 0.14% (3rd percentile) and no CISA KEV entry is provided, though a public PoC reference exists and is not verified as working exploit code.
RemediationAI
Apply the upstream fix commit c2676fe49d0da44d66e7d750e72c57d2670f0b8f (https://github.com/libyal/libfvde/commit/c2676fe49d0da44d66e7d750e72c57d2670f0b8f) or a later libfvde release containing it; the change rejects xml_plist_data_size values greater than block_data_size - 16. Patch status is available from the vendor via that commit, but a tagged released version with the fix is not independently confirmed in the supplied data, so verify the build in use includes the added bound check before considering the issue closed. Until then, do not open untrusted or attacker-supplied FileVault 2 Core Storage volume images with libfvde-based tools, and isolate such parsing in a separate low-privilege process so that a crash does not take down the primary application; these steps reduce the denial-of-service impact but do not fix the root cause. Track the vendor issue at https://github.com/libyal/libfvde/issues/70 for release status.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libfvde is the libyal library for reading FileVault 2 encrypted volumes. Encrypted metadata is stored as plist records identified by type codes, and type 0x0024 carries XML plist data whose declared size (xml_plist_data_size) drives a copy out of the compressed metadata block during libfvde_encrypted_metadata_read_type_0x0024(). The flaw is CWE-125 (out-of-bounds read): the code at libfvde_encrypted_metadata.c lines 3798-3813 only compares xml_plist_data_size with the remaining compressed data size and does not also bound it against the source block size minus its 16-byte header, so an oversized value makes libfvde_volume_open() read beyond the heap block buffer. The upstream fix commit c2676fe adds the second comparison (xml_plist_data_size > block_data_size - 16) and separately reworks the related type 0x001a path so that XML string scanning is bounded by xml_plist_data_size instead of an unbounded narrow_string_length() call. The supplied sources describe only a crash from the read overflow; no write primitive or information disclosure mechanism is documented.
Know when Libfvde gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local parsing of an attacker-supplied volume that the victim must open gives AV:L/UI:R/PR:N; the out-of-bounds read only crashes the process, so C:N/I:N and A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap block buffer, crashing the application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB