setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

CVE-2026-40025: Out-of-bounds Read

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrappedkeyparser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS...

PT-2026-31462

Name of the Vulnerable Software and Affected Versions The Sleuth Kit versions through 4.14.0 Description The Sleuth Kit contains a flaw in the APFS filesystem keybag parser. The wrapped key parser class does not properly validate length fields, leading to potential out-of-bounds reads when...