The vulnerability is an integer underflow in libfsapfs_key_encrypted_key_read_data that triggers a heap out‑of‑bounds read when processing malformed KEK attributes in an encrypted APFS image. Attackers can supply a crafted encrypted image with incorrect HMAC or wrapped KEK lengths, causing a read of adjacent heap memory before password verification. The result is the exposure of sensitive data that resides on the heap, potentially leaking passwords, cryptographic keys, or other confidential information, but does not provide direct code execution. The weakness is classified as CWE‑125, a classic out‑of‑bounds read weakness.

The affected product is the libyal:libfsapfs library, which is used by tools such as fsapfsinfo, pyfsapfs, dfVFS, and plaso to parse APFS images. No specific version numbers are listed besides the indication that the issue exists up to and including the 20260921 release. All deployments of libfsapfs prior to the corrected release are vulnerable, particularly when processing untrusted or user‑supplied encrypted APFS files.

The CVSS score of 6.9 indicates a moderate severity vulnerability that offers confidentiality impact. The EPSS score of < 1% shows a very low likelihood of exploitation in recent time, and the vulnerability is not listed in the CISA KEV catalog. Attackers must supply a specially crafted encrypted APFS image; therefore the likely attack vector is local, via tools that process untrusted filesystem images, or remote if such images can be uploaded to a service exposing these tools. Exploitation requires only reading data, not executing code, but can still expose sensitive information that may aid further attacks.