libfvde CVE-2026-116729

Exploitation requires the attacker to supply a crafted FileVault 2 volume in which the XML plist data embedded in encrypted metadata type 0x001a is NOT NUL-terminated, and requires a victim or application to open that volume with libfvde_volume_open() (CVSS UI:P - passive interaction, i.e. someone must load the malicious image). It is a local attack vector (AV:L), not network-exposed: the library must be fed the hostile input locally, so realistic targets are forensic/DFIR workflows and automated triage tools that ingest untrusted disk images. No authentication is required (PR:N), but the dependence on a victim opening a malicious volume and the limitation to an out-of-bounds read (rated availability-only, VA:L) sharply constrain real-world impact to crashing the parsing process rather than system compromise.

This is a genuinely low-to-medium real-world risk, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8 (Medium) and describes a local-vector, passive-user-interaction flaw whose only rated impact is limited availability (VA:L) - i.e. a crash from an out-of-bounds read, not code execution or confidentiality loss. EPSS is very low (0.13%, 3rd percentile), and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation; these two signals agree that mass exploitation is unlikely. The vuln.today Decision label is 'this_month' (not act_now/emergency), which matches a patch-on-normal-cadence posture rather than an emergency. One worth-noting tension: the input Tags include 'Information Disclosure' and the CWE is CWE-125 (out-of-bounds read), yet the vendor CVSS marks confidentiality VC:N and only availability VA:L - so despite the 'read' primitive the rated outcome is a crash, not confirmed data leakage; whether the OOB read can actually exfiltrate heap contents is not established in the sources. Overall this is a high-confidence-but-low-urgency memory-safety bug in a niche forensic library, not a high-CVSS-but-overhyped internet-facing threat.

An attacker crafts a malicious FileVault 2 volume image whose embedded XML plist data in encrypted-metadata type 0x001a is not NUL-terminated, then gets a victim (e.g. a forensic analyst, DFIR tool, or automated triage pipeline) to open it via software built on libfvde. When libfvde_volume_open() parses the metadata, an unbounded strlen reads past the heap block buffer, crashing the process or potentially exposing adjacent heap memory. A public technical write-up describing the bug exists (hackmd analysis plus the libyal issue tracker), but it is not verified as working, weaponized exploit code.