CVE-2026-40025
Out-of-Bounds Read in Sleuth Kit APFS Parser Causes Info Disclosure
Publication date: 2026-04-08
Last updated on: 2026-04-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sleuthkit | the_sleuth_kit | to 4.15.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Sleuth Kit allows an attacker to cause information disclosure by exploiting an out-of-bounds read in the APFS filesystem keybag parser. This could potentially expose sensitive data when processing malicious APFS disk images.
Such information disclosure risks may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or leaks.
However, the provided information does not explicitly detail the direct effects on compliance or specific regulatory implications.
Can you explain this vulnerability to me?
This vulnerability exists in The Sleuth Kit up to version 4.14.0, specifically in the APFS filesystem keybag parser. The issue arises because the wrapped_key_parser class processes length fields controlled by an attacker without proper bounds checking. This leads to out-of-bounds heap reads past the allocated buffer.
An attacker can exploit this by crafting a malicious APFS disk image that, when parsed by any Sleuth Kit tool handling APFS volumes, can cause information disclosure or application crashes.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure, meaning sensitive data could be exposed unintentionally. Additionally, it can cause the affected tools to crash, potentially disrupting forensic or analysis workflows that rely on The Sleuth Kit for APFS volume parsing.