A heap out-of-bounds read vulnerability exists in libfvde through version 20260923. The flaw occurs in the function libfvde_encrypted_metadata_read_type_0x001a() due to an unbounded strlen operation on embedded XML plist data that is not properly NUL-terminated. An attacker can craft a malicious FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read beyond the allocated heap buffer. This vulnerability has a low severity score and does not impact confidentiality or integrity but can cause availability issues.