Integer Underflow Vulnerability in Dislocker Affects Multiple Versions
CVE-2026-107635

6.8MEDIUM

Key Information:

Vendor

Aorimn

Status
Dislocker
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107635?

The Dislocker product, specifically version 0.7.3, contains an integer underflow vulnerability in the functions get_vmk() and get_fvek(). This flaw allows attackers to exploit crafted BitLocker volume images where the datum_size is deliberately set smaller than the required 36-byte AES-CCM header. Such an attack can lead to out-of-bounds heap reads, which may result in a crash of the Dislocker application, compromising the stability and security of systems using the software.

Affected Version(s)

dislocker 0 <= 0.7.3

References

https://github.com/Aorimn/dislocker/commit/0706462db88efe...
patch
https://github.com/Aorimn/dislocker/blob/v0.7.3/src/metad...
technical-description
https://github.com/Aorimn/dislocker/blob/v0.7.3/src/metad...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (@TristanInSec), Talence Security
.