CVE-2026-111133

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

CVE-2026-111133 libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

CVE-2026-111133

The libfsapfs library (versions through 20260921 ) is vulnerable to an integer underflow in the libfsapfs_key_encrypted_key_read_data() function. An attacker can provide a crafted encrypted APFS image containing malformed HMAC or wrapped KEK attribute lengths to trigger heap out-of-bounds reads ....

EUVD-2026-102260

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

libyal:libfsapfs_file_entry_fuzzer: Heap-buffer-overflow in libfsapfs_inode_read_value_data

Detailed Report: https://oss-fuzz.com/testcase?key=5178981822365696 Project: libyal Fuzzing Engine: afl Fuzz Target: libfsapfsfileentryfuzzer Job Type: aflasanlibyal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60b00000015b Crash State: libfsapfsinodereadvaluedata...