{"id":"CVE-2026-111133","summary":"libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data","details":"libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.","modified":"2026-10-17T07:06:57.437980923Z","published":"2026-10-15T18:57:27.812Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111133.json"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111133.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111133"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libfsapfs-through-20260921-heap-out-of-bounds-read-via-libfsapfs-key-encrypted-key-read-data"},{"type":"PACKAGE","url":"https://github.com/libyal/libfsapfs"},{"type":"ARTICLE","url":"https://github.com/libyal/libfsapfs/blob/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb/libfsapfs/libfsapfs_key_encrypted_key.c#L321-L333"},{"type":"ARTICLE","url":"https://github.com/libyal/libfsapfs/blob/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb/libfsapfs/libfsapfs_key_encrypted_key.c#L528-L540"},{"type":"ARTICLE","url":"https://hackmd.io/@haind-pwn/libfsapfs-key-encrypted-key-attribute-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libyal/libfsapfs","events":[{"introduced":"0"},{"fixed":"4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"20260921"},{"fixed":"20260921"}]}}],"versions":["20260917"],"database_specific":{"vanir_signatures_modified":"2026-10-17T07:06:57Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111133.json","vanir_signatures":[{"deprecated":false,"digest":{"length":3508,"function_hash":"293833100350714438094265347336811841890"},"id":"CVE-2026-111133-28f79b7c","signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"fsapfstools/mount_handle.c","function":"mount_handle_open"}},{"source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"tests/fsapfs_test_compressed_data_handle.c","function":"fsapfs_test_compressed_data_handle_read_segment_data"},"deprecated":false,"digest":{"function_hash":"287281532120097120628001374278913399664","length":4494},"id":"CVE-2026-111133-2b37953a","signature_type":"Function","signature_version":"v1"},{"target":{"file":"fsapfstools/mount_handle.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["110180077643458189539295410245738847296","201117558092477355070195400720903868417","140555101667335782885087458599625076236","68407779017036093788442388313209939619","36867105527597227190554338833441920511","3247932695156612802933225159093863128","281244111313576303601570382747356127307","227042221438053058300293028638303778903","98756051582143760956368621011027549491","191269312963301874626105264336763990690","130303484007833174713122860595502576508","297284469105071116724327922783139534812","67728501643703088104073857647272407798","69233929727994519859206942210636894221","338875500231327984214584874623293821818","245638842275511092167198774716049800548","339428267423081097196313823350391217810","177778220836303332904533264104596807004","29149795292054747266311350702206866465","285767994032556855802997416481519878160","236793525662505126542784428616785381058","117434036847711436331029351117608234587","160496589847355327583436337692360512108","92627661079569070363424607676748434745","124096456802248440621295907400199760091","194562355953836666274961797295857159947","46239394668764937535348036021912569245","21744034877953481823313446588502245380","161492757888782124234431321620680334827","208926763164316954830255076002099120217","228105988751447931704359997896084910157","146009056187436906256003985638788511137","242077437296815758984452223830596231712","234182368658546391362701690523713015200","200728265683391983335643700310161208093","269386540786914853489617163809318943387","299192747196887385352694795369592192881","177748519012589809013205371386857504062","20360909279117310852834477225826748956","123673985780758071239516369816534425697","306236945334424433874018016025860102988","109360426037505592281482620377727132966","299948796474837096920418898004192631693","85575918910034966294171245586264666304","179031471037937308967554276235691067811","272417131327196487749003332636893098933","89957187884204218290333929583253682252","124518678525000204155327341643273706957","50540574968346232564770846124795848183","214111263777004446755541879294607930137"]},"id":"CVE-2026-111133-37ebeaba","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb"},{"id":"CVE-2026-111133-6014471c","signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"tests/fsapfs_test_compressed_data_handle.c","function":"fsapfs_test_compressed_data_handle_seek_segment_offset"},"deprecated":false,"digest":{"length":1577,"function_hash":"158621627008063357885015023946166019366"}},{"deprecated":false,"digest":{"function_hash":"133867351309184014078557823781612365004","length":1490},"id":"CVE-2026-111133-6188b975","signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"fsapfstools/mount_handle.c","function":"mount_handle_close"}},{"source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"libfsapfs/libfsapfs_compressed_data_handle.c","function":"libfsapfs_compressed_data_handle_free"},"deprecated":false,"digest":{"function_hash":"68949840086868988426846226479946662527","length":691},"id":"CVE-2026-111133-628bd1cd","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["79551228206574509213040563099192830878","104183343982584812274870147269615320391","315678543644241238767892692392930692496","265806545879187257944044008320524000472","308213659046061705408943607206061665850","303433993170356833237449948774111023430","123045805442290068366165082510324005805","229410729586681076473181233777643859537","199911398221626834036139608408713778213","111873441120635127088994336086123849008","330361459546938616981468373311047453041","289547363193013705145776431314067856343","184963231331557763530446419978777963792","183165049852455942386832834970209160909","38989694732976972016991407071920442705","20871426190644570105344240601023191293","221478570591210106397729319666133184760","243405087577060775240403334259310741452","199281272776386286244414962320918217308","25580196968945543028580508021834105787","195069486023586861814834901747791720357","36805921324834944541236543570861905115","100546083507842889378058003493131388250","78690071578138298455458148488914518297","107945418561166826868923964333015299823","336640010983410145893395453485926466060","3250590361530615769391111914587762860","71511003144986076441058545605643376710","199322450293627457977857927711835189344","2565569924526920297820805391460173093","173056762582576388637800086530840260939","176020694715485707728794648141979845076","233090794141670620311522568404147572863","72535409092681697649553941767903530620","182592532442982640110744275569044321883","203977912012612427699602507752810988343","123033984917618732667814088128775551781","48396871421201984284191207345378198046","194229450944355603448374411105530181330","129532248826059709762828688085448387907","326103146228791184027782404397018417333","298621419657524768069594945015596633004"]},"id":"CVE-2026-111133-a1087ad4","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"libfsapfs/libfsapfs_compressed_data_handle.c"}},{"signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"function":"fsapfs_test_compressed_data_handle_initialize","file":"tests/fsapfs_test_compressed_data_handle.c"},"deprecated":false,"digest":{"function_hash":"101531969327540848777305824945117069807","length":2942},"id":"CVE-2026-111133-a81ce499","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"libfsapfs/libfsapfs_compressed_data_handle.c","function":"libfsapfs_compressed_data_handle_get_compressed_block_offsets"},"deprecated":false,"digest":{"length":11078,"function_hash":"321622224045671731060355226369494280511"},"id":"CVE-2026-111133-bcde999d"},{"deprecated":false,"digest":{"line_hashes":["254743177150174314828250046641047457721","92442400573110263930451222308869652964","239432689034277861665841299856060500707","312558984736378731651713832508024034722","101189941528386562321662400478191496416","94673677482625847077148617838156398930","108856282422668284258828346378292259735","16097280204705551414820791266640619667","90254445083636662818915339201763024854","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","192874073589362756672815221082045554038","291209178136239531748765699361494848585","95118508888932754354348744248821312381","108856282422668284258828346378292259735","16097280204705551414820791266640619667","90254445083636662818915339201763024854","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","192874073589362756672815221082045554038","291209178136239531748765699361494848585","268015905207434605108206176377979474332","108856282422668284258828346378292259735","16097280204705551414820791266640619667","90254445083636662818915339201763024854","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","192874073589362756672815221082045554038","291209178136239531748765699361494848585","21100696599784554168601036946338070327","108856282422668284258828346378292259735","214582594962116507277217716950116643823","97364764410162522824054566957679852647","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","216480584600603960692816924498167038266","311088499927184133799394767624556144654","282478597167055021473144039236057248854","337680583277555147034838675469070424262","71856228236282625884015245889791964862","286019811796342223000252510242396883260","210023989859206405926837957115691921728","230872006379691307600910354234365310452","279493564313359419292490427550484635477","80206793349539859191694773351757019300","254743177150174314828250046641047457721","92442400573110263930451222308869652964","239432689034277861665841299856060500707","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","192874073589362756672815221082045554038","291209178136239531748765699361494848585","95118508888932754354348744248821312381","230872006379691307600910354234365310452","279493564313359419292490427550484635477","80206793349539859191694773351757019300","38620940711539921344307243138424768212","61166649850089305431906172714496440600","260596215304891570240048007507679658915","224516998645984022957605586028997788920","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","192874073589362756672815221082045554038","291209178136239531748765699361494848585","268015905207434605108206176377979474332","230872006379691307600910354234365310452","279493564313359419292490427550484635477","80206793349539859191694773351757019300","38620940711539921344307243138424768212","61166649850089305431906172714496440600","260596215304891570240048007507679658915","224516998645984022957605586028997788920","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","192874073589362756672815221082045554038","291209178136239531748765699361494848585","21100696599784554168601036946338070327","110772566654246704400398942643123505168","324804256038779878976690663692796480745","146553449247149878881959146486343193488","175567576754589219746508693287276449478","297013900588293438730588997910568137657","200192451945404832296322806383942573945","144022596631959613915912715256645357442","235945995387666590448602733903967430222","328768515059368957645031996053171323100","270505739350566778773630894614752445990","185899821441505978328285153927970078154","65677579582790707085693610521357267213","312558984736378731651713832508024034722","49176338726421077872845563595214468758","205221226311603275297173423907252875893","286664369326505958653843049179933039413","273396355078437515294633845009519777932","237059858415485400750705634130389370126","234746948078009729474766247805659509480","116157794901153596954589500808063758630","297013900588293438730588997910568137657","200192451945404832296322806383942573945","144022596631959613915912715256645357442","140372900145023830655531320749839923316","55062266960431919305943662292371878617","242983385995424543064266499033534994337","164953829761755094879241631193197045631","302507462050688179684802090486070748953","230872006379691307600910354234365310452","311307706429443656554732727443477570567","150450435968189856090795805343522458082","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","216480584600603960692816924498167038266","311088499927184133799394767624556144654","282478597167055021473144039236057248854","267733391906456802335555177590464632806","189887425793955468072054977413578085040","90838246737659946984620952352602144504","297855392638968100690782418276749793093","179823419677595777504059096142812001977","116977638780733972688778925922546405008","87238397853947611421426403054351393609","123441869179114118982566977066960612818","297013900588293438730588997910568137657","200192451945404832296322806383942573945","331099303584114847021796465289209026876","174887634430947382834410248418088996767","36697648021477767059750093296847743339","303417534066560948129123345335255698033","185899821441505978328285153927970078154","65677579582790707085693610521357267213","216480584600603960692816924498167038266","311088499927184133799394767624556144654","282478597167055021473144039236057248854"],"threshold":0.9},"id":"CVE-2026-111133-cf88d08f","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"tests/fsapfs_test_compressed_data_handle.c"}},{"signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"function":"fsapfs_test_compressed_data_handle_get_compressed_block_offsets","file":"tests/fsapfs_test_compressed_data_handle.c"},"deprecated":false,"digest":{"function_hash":"337517890250854156237080853850957629683","length":3492},"id":"CVE-2026-111133-d1bd341e","signature_type":"Function"},{"source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"fsapfstools/mount_handle.c","function":"mount_handle_get_volume_by_index"},"deprecated":false,"digest":{"length":2500,"function_hash":"187459978798673529788742320896507201171"},"id":"CVE-2026-111133-ec93f684","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-111133-fd7c4737","signature_type":"Line","signature_version":"v1","source":"https://github.com/libyal/libfsapfs/commit/4c7c1c21f3cfc7d35f0b34b8a47f1f1562d27bbb","target":{"file":"fsapfstools/mount_handle.h"},"deprecated":false,"digest":{"line_hashes":["51679779791363630257616602037176001864","255358865427589143818836324107000342968","170723690939627842076223597308850342498","126944378827265788435180183134056997303","17038815098714111277810754083055611316","85575918910034966294171245586264666304","179031471037937308967554276235691067811","141468727767735492386674444840402601508"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}