Heap Out-of-Bounds Read Vulnerability in libfvde Product by libyal
CVE-2026-116729
4.8MEDIUM
What is CVE-2026-116729?
libfvde, a product of libyal, contains a vulnerability that arises due to an unbounded string length measurement on XML plist data. Specifically, in the function libfvde_encrypted_metadata_read_type_0x001a(), a crafted FileVault 2 volume with improperly terminated plist data can lead to heap out-of-bounds reads. This allows attackers to cause libfvde_volume_open() to access memory regions beyond the heap block buffer, potentially leading to information disclosure or other negative effects.
Affected Version(s)
libfvde 0 <= 20260923
References
CVSS V4
Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology