TI-2026-80937 Aliases CVE-2026-116728 GHSA-7qjq-mq3w-jp59

libfvde Heap Out-of-Bounds Read in Encrypted Metadata Parsing

LOW 29CWE-125Published 2026-10-26 · Updated 2026-10-31

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

libfvde through 20260923 has a heap out-of-bounds read in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block (CWE-125). An attacker who supplies a crafted FileVault 2 Core Storage volume can make libfvde_volume_open() copy past the heap block buffer, crashing the application. The CVSS 4.0 base score is 6.8 (MEDIUM), with a local attack vector, user interaction required and high availability impact. CISA has not listed it in KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap block buffer, crashing the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00136 3rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
libyal	libfvde	up to 20260923	—	No fix listed	CNA

libfvde Vendorlibyal Affected up to 20260923 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libfvde through 20260923 (status: no fix listed). Until a fix is available, do not open FileVault 2 Core Storage volumes from untrusted sources with libfvde.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Timeline

2026-10-26 Threatist record created from CVE-2026-116728
2026-10-27 Alias added: GHSA-7qjq-mq3w-jp59
2026-10-27 Priority changed: MEDIUM → LOW
2026-10-31 CISA SSVC decision points changed

References

Patch 1

https://github.com/libyal/libfvde/commit/c2676fe49d0da44d66e7d750e72c57d2670f0b8f

Advisory 1

https://hackmd.io/@haindpwn/libfvde-encrypted-metadata-oob-read

Other 3

TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
TI-2026-80944 Heap out-of-bounds read in libpff table record parsing CVSS 4.0MEDIUM 6.9
TI-2026-74943 Heap out-of-bounds read in libewf L01 extended attribute parsing CVSS 4.0MEDIUM 6.9
TI-2026-74931 Heap out-of-bounds read in libyal libesedb multi-value handling CVSS 4.0MEDIUM 6.9
TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
TI-2026-74919 libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data CVSS 4.0MEDIUM 6.9

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences