libfvde, a library that processes FileVault 2 Core Storage volumes, contains a heap out‑of‑bounds read flaw (CWE‑125) in the function libfvde_encrypted_metadata_read_type_0x0024(). The routine does not verify that xml_plist_data_size is within the bounds of the source metadata block, allowing a crafted volume to cause libfvde_volume_open() to copy memory beyond the allocated buffer. The overread results in a crash of the consuming application, which manifests as a denial of service.

The vulnerability affects the libyal libfvde library through version 20260923. Any software, utility, or third‑party application that links to libfvde to open a FileVault 2 volume is potentially impacted.

The CVSS score of 6.8 classifies the issue as moderate severity. EPSS information is not available, so the probability of exploitation remains indeterminate. The vulnerability is not included in the CISA KEV catalog, implying no widespread exploitation is currently documented. The likely attack vector is an attacker supplying a maliciously crafted FileVault 2 volume file; this could be delivered via phishing, remote file transfer, or by any mechanism that allows an untrusted user to supply a volume to a libfvde‑aware application. The impact is limited to service disruption, with no data compromise or privilege escalation.