libfsapfs EUVD-2026-102260

Exploitation requires the victim to parse an attacker-supplied, specially crafted encrypted APFS image using libfsapfs or one of its consumers (fsapfsinfo, pyfsapfs, dfVFS, or plaso); the crafted image must contain malformed HMAC or wrapped-KEK attribute lengths that drive the integer underflow in libfsapfs_key_encrypted_key_read_data(). No decryption password or key is needed because the over-read occurs before password checks, which broadens the trigger surface. Limiting factors that reduce real-world risk: the attack vector is local (the malicious file must be delivered to and opened on the analyst's system, not reachable over a network), and user/analyst interaction is required (UI:P) - the image must be actively processed. No special non-default configuration is required beyond normal use of the library to parse an APFS image.

This is a medium-severity (CVSS 4.0 base 6.9) memory-safety issue whose real-world priority is modest and context-specific. The CVSS vector is the strongest available signal: AV:L and UI:P mean exploitation is not remote or automatic - an attacker cannot reach the flaw over a network but must get a victim to parse a crafted encrypted APFS image locally, which caps mass-exploitation potential. No EPSS score, no CISA KEV listing, and no explicit exploit-code flag were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation-relevant artifact is a third-party technical write-up (hackmd) plus source-line references, which demonstrate the bug but are not a confirmed weaponized exploit. Impact is split: VC:L (limited heap memory disclosure, i.e. an information leak of adjacent heap bytes) and VA:H (reliable crash/DoS of the parsing tool), with no integrity impact (VI:N). SSVC-style framing: exploitation=none observed, automatable=no (requires user to open a malicious file), technical impact=partial. The notable detail raising its relevance for forensics workflows is that the over-read occurs 'before password checks,' so no decryption key or credential is needed to trigger it. Net assessment: a genuine anti-forensics / analyst-targeting bug worth patching in DFIR toolchains, but not a drop-everything emergency - it is a real-but-contained issue rather than a high-CVSS-but-inflated one, and the moderate score accurately reflects that.

An attacker crafts a malicious encrypted APFS disk image with malformed HMAC or wrapped-KEK attribute lengths and gets it into a forensic analyst's processing pipeline (e.g. as 'evidence' submitted for analysis). When the analyst runs fsapfsinfo, pyfsapfs, dfVFS, or plaso against the image, an integer underflow triggers a heap out-of-bounds read, crashing the tool and/or leaking adjacent heap memory - all before any password verification. No public exploit code was identified in the provided data, though a technical write-up describing the flaw exists.