CVE-2026-107634
Received Received - Intake

Heap Out-of-Bounds Read in Dislocker

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description
Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107634
EUVD
EUVD-2026-95021

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Aorimn dislocker 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-107634 is a heap out-of-bounds read vulnerability in Dislocker through version 0.7.3. It occurs in the functions get_dataset() and get_next_datum() where dataset and datum sizes are not validated against metadata allocation. Attackers can craft a BitLocker volume with inflated sizes, causing Dislocker to crash or disclose adjacent heap memory when the volume is opened or mounted.

Detection Guidance

To detect this vulnerability, check the installed version of Dislocker. If you are using version 0.7.3 or earlier, the system is vulnerable. Run: dislocker --version. If the output shows 0.7.3 or lower, the system is affected.

Impact Analysis

This vulnerability could allow attackers to crash Dislocker or expose sensitive memory contents when a crafted BitLocker volume is accessed. Since Dislocker runs with root privileges under FUSE, successful exploitation might lead to system instability or potential information disclosure.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through heap memory disclosure when processing BitLocker-encrypted volumes. Unauthorized access to adjacent heap memory may lead to data leaks, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Dislocker to the latest version from the official repository. Apply the patches in the metadata.c and datums.c files. Avoid mounting untrusted BitLocker volumes until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart