Heap Out-of-Bounds Read in libfvde Affects Data Encryption
CVE-2026-116728

6.8MEDIUM

Key Information:

Vendor

Libyal

Status
Libfvde
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116728?

The libfvde library, utilized for FileVault 2 Core Storage volume encryption, is susceptible to a heap out-of-bounds read vulnerability. This occurs in the function libfvde_encrypted_metadata_read_type_0x0024, where the size of the XML plist data is not adequately validated against the source metadata block. By supplying a specially crafted FileVault 2 Core Storage volume, an attacker can exploit this flaw, leading to an overflow beyond the heap buffer. Such exploitation may cause the application to crash, compromising data accessibility and stability. Organizations using libfvde should assess their deployments for potential risks and apply available patches.

Affected Version(s)

libfvde 0 <= 20260923

References

https://github.com/libyal/libfvde/issues/70
issue-tracking
https://github.com/libyal/libfvde
product
https://github.com/libyal/libfvde/commit/c2676fe49d0da44d...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.