CVE-2026-111133

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

CVE-2026-111133

The libfsapfs library (versions through 20260921 ) is vulnerable to an integer underflow in the libfsapfs_key_encrypted_key_read_data() function. An attacker can provide a crafted encrypted APFS image containing malformed HMAC or wrapped KEK attribute lengths to trigger heap out-of-bounds reads ....

CVE-2026-111133 libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...