Live › vulnerability › CVE-2026-116728
Go to dashboardlibfvde, a library for reading FileVault 2 encrypted volumes, does not check a size field against the metadata block when parsing a volume. A crafted FileVault 2 Core Storage volume can make it copy past a heap buffer, which crashes the application that opens the volume.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap block buffer, crashing the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-116728")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.