CVE-2026-116728

Name of the Vulnerable Software and Affected Versions libfvde versions prior to 20260924

Description A heap out-of-bounds read occurs in the libfvde encrypted metadata read type 0x0024() function because the xml plist data size variable is not validated against the source metadata block. An attacker can provide a specially crafted FileVault 2 Core Storage volume that causes the libfvde volume open() function to copy data beyond the heap block buffer, leading to an application crash.

Recommendations Update libfvde to a version released after 20260923.