CVE-2026-111133: Out-of-bounds Read in libyal libfsapfs

The vulnerability CVE-2026-111133 affects libfsapfs through version 20260921. An integer underflow in libfsapfs_key_encrypted_key_read_data() allows attackers to supply specially crafted encrypted APFS images with malformed HMAC or wrapped KEK attribute lengths, triggering heap out-of-bounds reads. This can cause crashes in dependent tools and potentially expose adjacent heap memory prior to password checks. The CVSS 4.0 score is 6.9 (medium severity) with local attack vector, low complexity, no privileges required, user interaction needed, and high impact on availability.

Successful exploitation can cause crashes (denial of service) in applications using libfsapfs such as fsapfsinfo, pyfsapfs, dfVFS, or plaso. Additionally, it may allow reading of adjacent heap memory before password verification, potentially exposing sensitive data. There is no indication of remote exploitation or privilege escalation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or crafted encrypted APFS images with vulnerable versions of libfsapfs. Monitor vendor channels for updates and apply official patches once released.