Libfvde
Monthly
A heap out-of-bounds read in libfvde's FileVault 2 encrypted metadata parser (metadata type 0x001a) can crash the application that opens an attacker-supplied volume, with impact limited to availability of the parsing process rather than data disclosure or code execution. The defect affects libfvde builds through the 20260923 snapshot and is reached when embedded XML plist data in an encrypted metadata block is not NUL-terminated, so libfvde_volume_open() executes an unbounded strlen that walks past the allocated heap block. The published CVSS 4.0 score is 4.8 (an assessed CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L matches the evidence), EPSS is 0.13% at the 3rd percentile, the issue is not listed in CISA KEV and is not confirmed actively exploited, and although a third-party technical write-up is referenced, no verified working exploit code is confirmed; realistic exposure is confined to forensic/DFIR tools and automated triage pipelines that ingest untrusted disk images.
Heap out-of-bounds read in libfvde through 20260923 can crash any application that opens a crafted FileVault 2 Core Storage volume via libfvde_volume_open(). The type 0x0024 encrypted-metadata parser uses an xml_plist_data_size value without checking it against the source metadata block, so a malicious volume image causes a read past the heap buffer and terminates the parsing process, with availability impact only and no confidentiality or integrity impact. The CVSS 4.0 vector is local (AV:L) with no privileges required (PR:N) and passive user interaction (UI:P); EPSS is 0.14% (3rd percentile) and no CISA KEV entry is provided, though a public PoC reference exists and is not verified as working exploit code.
A heap out-of-bounds read in libfvde's FileVault 2 encrypted metadata parser (metadata type 0x001a) can crash the application that opens an attacker-supplied volume, with impact limited to availability of the parsing process rather than data disclosure or code execution. The defect affects libfvde builds through the 20260923 snapshot and is reached when embedded XML plist data in an encrypted metadata block is not NUL-terminated, so libfvde_volume_open() executes an unbounded strlen that walks past the allocated heap block. The published CVSS 4.0 score is 4.8 (an assessed CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L matches the evidence), EPSS is 0.13% at the 3rd percentile, the issue is not listed in CISA KEV and is not confirmed actively exploited, and although a third-party technical write-up is referenced, no verified working exploit code is confirmed; realistic exposure is confined to forensic/DFIR tools and automated triage pipelines that ingest untrusted disk images.
Heap out-of-bounds read in libfvde through 20260923 can crash any application that opens a crafted FileVault 2 Core Storage volume via libfvde_volume_open(). The type 0x0024 encrypted-metadata parser uses an xml_plist_data_size value without checking it against the source metadata block, so a malicious volume image causes a read past the heap buffer and terminates the parsing process, with availability impact only and no confidentiality or integrity impact. The CVSS 4.0 vector is local (AV:L) with no privileges required (PR:N) and passive user interaction (UI:P); EPSS is 0.14% (3rd percentile) and no CISA KEV entry is provided, though a public PoC reference exists and is not verified as working exploit code.