Dislocker EUVD-2026-95021

Exploitation requires the victim to open or mount an attacker-crafted BitLocker volume image whose metadata announces dataset or datum sizes larger than the allocated metadata buffer; the flawed get_dataset() and get_next_datum() paths then walk past the allocation. There is no special dislocker configuration needed - any default use of a vulnerable build (≤0.7.3) that parses the malicious image is affected. Limiting factors that reduce real-world risk: the attack vector is LOCAL (the attacker cannot reach the parser over a network - a malicious file must be delivered and processed), and it requires user interaction (UI:P) in that a victim must actually invoke dislocker on the crafted image, typically in forensic, incident-response, or disk-recovery workflows that handle untrusted BitLocker volumes.

This is a genuinely Medium-severity, lower-priority issue rather than an urgent one. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 6.9 and tells a consistent story: exploitation is LOCAL (the attacker must get dislocker to process an attacker-supplied BitLocker image) and requires passive user interaction (the victim opening or mounting that image). It is unauthenticated (PR:N) but not remotely reachable. Impact is an availability hit (VA:H, crash/DoS) plus limited confidentiality loss (VC:L, disclosure of adjacent heap memory via CWE-125 out-of-bounds read); no integrity impact. No EPSS probability, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation - neither KEV nor POC is present, meaning no public exploit is identified at time of analysis. Combined with a local attack vector, mandatory user interaction, and a niche product footprint, real-world risk is well below what a raw 'High' label might suggest. The one caveat: this parses untrusted, attacker-controlled forensic/volume images, which is exactly the threat model where a memory-safety bug matters, so it should still be patched. A vendor patch is available and this is the recommended action.

An attacker crafts a malicious BitLocker volume image declaring inflated dataset or datum sizes and delivers it to a victim (e.g., a USB drive, downloaded disk image, or forensic artifact submitted for analysis). When the victim opens or mounts the image with a vulnerable dislocker (≤0.7.3), the datum-walking code reads past the metadata heap allocation, either crashing the process or leaking adjacent heap memory into output. No public POC is identified, and the local vector plus required user interaction (UI:P) mean the attacker must socially engineer or otherwise induce the victim to process the file.