What’s Vulnerable › Vulnerabilities

CVE-2026-111133: libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-125

Description

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

Affected products

• libyal libfsapfs: through 20260921

References

• https://github.com/libyal/libfsapfs
• https://github.com/libyal/libfsapfs/blob/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb/libfsapfs/libfsapfs_key_encrypted_key.c#L321-L333
• https://github.com/libyal/libfsapfs/blob/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb/libfsapfs/libfsapfs_key_encrypted_key.c#L528-L540
• https://hackmd.io/@haind-pwn/libfsapfs-key-encrypted-key-attribute-oob-read
• https://www.vulncheck.com/advisories/libfsapfs-through-20260921-heap-out-of-bounds-read-via-libfsapfs-key-encrypted-key-read-data
• https://hackmd.io/@haind-pwn/libfsapfs-key-encrypted-key-attribute-oob-read

Get alerted when CVE-2026-111133 or the next vulnerability affects your stack