Read the docs
TI-2026-69585 Aliases CVE-2026-107635GHSA-v459-vrm9-x34f

Dislocker integer underflow causes out-of-bounds heap read

Priority LOW 29CWE-191Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dislocker through 0.7.3 contains an integer underflow in get_vmk() and get_fvek() that lets hexdump() read past a heap buffer. An attacker who supplies a malicious BitLocker volume image with a datum size smaller than the 36-byte AES-CCM header can trigger the over-read, which crashes dislocker. The flaw is classified as CWE-191, and exploitation requires a user to process the crafted image.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datum_size smaller than the 36-byte AES-CCM header, causing hexdump() to over-read and crash dislocker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aorimndislockerup to 0.7.3—No fix listedCNA
  • dislocker VendorAorimn Affected up to 0.7.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for dislocker.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107635
  2. 2026-10-08 Alias added: GHSA-v459-vrm9-x34f
  3. 2026-10-10 Affected versions changed · Red Hat
  4. 2026-10-10 CVSS score added · Red Hat
  5. 2026-10-16 CVSS score changed · CNA

References

Patch 1

Other 3

  • TI-2026-69584 Dislocker Heap Out-of-Bounds Read via BitLocker Dataset Size CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences