CVE-2026-40025
Received Received - Intake
Out-of-Bounds Read in Sleuth Kit APFS Parser Causes Info Disclosure

Publication date: 2026-04-08

Last updated on: 2026-04-15

Assigner: VulnCheck

Description
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-15
Generated
2026-05-07
AI Q&A
2026-04-09
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sleuthkit the_sleuth_kit to 4.15.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability in Sleuth Kit allows an attacker to cause information disclosure by exploiting an out-of-bounds read in the APFS filesystem keybag parser. This could potentially expose sensitive data when processing malicious APFS disk images.

Such information disclosure risks may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or leaks.

However, the provided information does not explicitly detail the direct effects on compliance or specific regulatory implications.


Can you explain this vulnerability to me?

This vulnerability exists in The Sleuth Kit up to version 4.14.0, specifically in the APFS filesystem keybag parser. The issue arises because the wrapped_key_parser class processes length fields controlled by an attacker without proper bounds checking. This leads to out-of-bounds heap reads past the allocated buffer.

An attacker can exploit this by crafting a malicious APFS disk image that, when parsed by any Sleuth Kit tool handling APFS volumes, can cause information disclosure or application crashes.


How can this vulnerability impact me? :

The vulnerability can lead to information disclosure, meaning sensitive data could be exposed unintentionally. Additionally, it can cause the affected tools to crash, potentially disrupting forensic or analysis workflows that rely on The Sleuth Kit for APFS volume parsing.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart