Out-of-Bounds Read Vulnerability in Sleuth Kit's APFS Filesystem Keybag Parser

CVE-2026-40025

What is CVE-2026-40025?

The Sleuth Kit, up to version 4.14.0, is vulnerable to an out-of-bounds read issue in its APFS filesystem keybag parser. This vulnerability arises when the wrapped_key_parser class processes attacker-controlled length fields without adequate bounds checking. Consequently, this flaw allows for heap reads beyond the allocated buffer. An attacker can exploit this vulnerability by creating a malicious APFS disk image, potentially leading to information disclosure or causing crashes during the processing of APFS volumes by Sleuth Kit tools.

References