CVE-2026-111133: libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data
libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.
Affected Software
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Systems or workflows that process encrypted APFS images using libfsapfs-based tools are exposed, including fsapfsinfo, pyfsapfs, dfVFS, and plaso. The affected input is a crafted encrypted APFS image containing malformed KEK attributes.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause a vulnerable tool or application to process a crafted encrypted APFS image. No privileges are required, but user interaction is required because the malicious image must be supplied to and opened or analyzed by the affected software.
Can exploitation occur without knowing the APFS password?
Yes. The out-of-bounds read can be triggered before password checks, using malformed HMAC or wrapped KEK attribute lengths.
What happens if the issue is triggered?
The crafted attributes can cause heap out-of-bounds reads, potentially exposing adjacent heap memory. They can also crash affected tools, creating a denial-of-service condition.