CVE-2026-40025
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.
Risk Assessment
An attacker can exploit this vulnerability to leak sensitive data from memory or cause crashes of forensic tools, disrupting analysis and potentially leading to loss of evidence.
Recommendation
It is recommended to upgrade The Sleuth Kit to a version above 4.14.0 when available, and avoid processing untrusted APFS images without verification.
Original NVD description (English source)
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.