CVE-2026-116729

Name of the Vulnerable Software and Affected Versions libfvde versions prior to 20260923

Description A heap out-of-bounds read occurs in the libfvde encrypted metadata read type 0x001a() function due to an unbounded strlen operation on embedded XML plist data. An attacker can trigger this by providing a specially crafted FileVault 2 volume containing non-NUL-terminated plist data, which leads the libfvde volume open() function to read beyond the heap block buffer.

Recommendations Update libfvde to a version released after 20260923.