CVE-2026-107634: Out-of-bounds Read in Aorimn dislocker

CVE-2026-107634 is a heap out-of-bounds read vulnerability in dislocker through version 0.7.3. The flaw exists in the get_dataset() and get_next_datum() functions, which fail to validate the sizes of datasets and data against the allocated metadata size. This allows an attacker to create a specially crafted BitLocker volume image with inflated dataset or datum sizes. When dislocker processes this image, it may read beyond the allocated heap memory, leading to a crash or disclosure of adjacent heap memory contents.

Successful exploitation can cause dislocker to crash, resulting in denial of service. Additionally, it may disclose adjacent heap memory, potentially leaking sensitive information. The vulnerability requires local access to open or mount a crafted BitLocker volume image and user interaction. The CVSS 4.0 score is 6.9 (medium severity), reflecting local attack vector, low complexity, no privileges required, and high impact on availability and confidentiality.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening or mounting untrusted or suspicious BitLocker volume images with dislocker.