CVE-2026-111133CWE-125

CVE-2026-111133

Medium · published October 15, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS v4.0
6.9 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00200 · 9.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-10-15T23:17Z
References (6)
https://github.com/libyal/libfsapfs · [email protected]https://github.com/libyal/libfsapfs/blob/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb/libfsapfs/libfsapfs_key_encrypted_key.c#L321-L333 · [email protected]https://github.com/libyal/libfsapfs/blob/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb/libfsapfs/libfsapfs_key_encrypted_key.c#L528-L540 · [email protected]https://hackmd.io/@haind-pwn/libfsapfs-key-encrypted-key-attribute-oob-read · [email protected]https://www.vulncheck.com/advisories/libfsapfs-through-20260921-heap-out-of-bounds-read-via-libfsapfs-key-encrypted-key-read-data · [email protected]https://hackmd.io/@haind-pwn/libfsapfs-key-encrypted-key-attribute-oob-read · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 18:57Z
    libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data
    cvelistv5
  • 15 OCT 18:57Z
    libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data
    cvelistv5