Description
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libyal libfvde
Default version status: unaffected
0 to ≤ 20260923affected
pkg:github/libyal/libfvdeReferences
- https://github.com/libyal/libfvde/issues/70 ↗
- https://github.com/libyal/libfvde ↗
- https://github.com/libyal/libfvde/commit/c2676fe49d0da44d66e7d750e72c57d2670f0b8f ↗
- https://github.com/libyal/libfvde/blob/20260923/libfvde/libfvde_encrypted_metadata.c#L2786-L2792 ↗
- https://hackmd.io/@haindpwn/libfvde-encrypted-metadata-oob-read ↗
- https://www.vulncheck.com/advisories/libfvde-through-20260923-heap-out-of-bounds-read-via-libfvde-encrypted-metadata-read-type-0x001a ↗