CVE-2026-116728: libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvdeencryptedmetadatareadtype0x0024() because xmlplistdatasize is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvdevolumeopen() copy past the heap block buffer, crashing the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use affected libfvde versions to open FileVault 2 Core Storage volumes are exposed. The impact described is an application crash caused while processing a crafted volume.
What does an attacker need to exploit it?
An attacker needs to supply a crafted FileVault 2 Core Storage volume and have it opened through libfvde_volume_open(). The vector is local and requires user interaction.
Is confidentiality or integrity affected?
The provided severity vector identifies availability impact only. It lists no confidentiality or integrity impact.
How can I determine whether an application may be affected?
Determine whether the application uses libfvde and opens FileVault 2 Core Storage volumes. The affected code path is libfvde_encrypted_metadata_read_type_0x0024(), reached when libfvde_volume_open() processes the crafted metadata.