CVE-2026-82525: Improper Restriction of XML External Entity Reference in Exterro FTK Imager

CVE-2026-82525 is an XXE injection vulnerability in Exterro FTK Imager prior to version 8.3. Attackers can embed malicious external entity references and XSLT stylesheets inside a Report.xml file within a UFDR ZIP archive. When an examiner previews this crafted archive, the XML parser resolves file:// external entity references and executes msxsl:script within the external stylesheet. This process allows arbitrary file reading from the host filesystem and exfiltration of file contents via a generated image URL to an attacker-controlled server.

Successful exploitation allows an attacker to read arbitrary files on the host system where FTK Imager is running and exfiltrate their contents. This can lead to unauthorized disclosure of sensitive information. The attack requires user interaction (previewing the malicious UFDR archive) and local access to run the vulnerable software. There is no indication of privilege escalation or remote code execution beyond the script execution within the XML parser context.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening or previewing untrusted UFDR ZIP evidence items in FTK Imager versions before 8.3.