Integer Underflow Vulnerability in libfsapfs Key Management by libyal
CVE-2026-111133
6.9MEDIUM
What is CVE-2026-111133?
An integer underflow vulnerability in the libfsapfs library allows attackers to conduct heap out-of-bounds reads through the libfsapfs_key_encrypted_key_read_data() function. Malicious actors can craft specific attributes for encrypted Apple File System (APFS) images, leveraging malformed HMAC or incorrect wrapped Key Encryption Key (KEK) lengths. As a result, this can lead to the crashing of tools such as fsapfsinfo, pyfsapfs, dfVFS, or plaso, while potentially exposing adjacent heap memory before any password checks are performed.
Affected Version(s)
libfsapfs 0 <= 20260921
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology