libfvde through 20260923 contains a heap out‑of‑bounds read vulnerability in the function libfvde_encrypted_metadata_read_type_0x001a(), caused by an unbounded strlen call on embedded XML plist data. When an attacker supplies a crafted FileVault 2 volume with non‑NUL‑terminated plist data, the libfvde_volume_open routine reads past the end of the heap block buffer. This can leak contiguous memory contents that may include sensitive information, leading to potential disclosure of data stored alongside the plist data during processing.

The affected product is libyal’s libfvde library, version 20260923 and earlier. The vulnerability is present in all releases before the fix committed in 20260923. Users of libfvde integrated within applications that process FileVault 2 volumes are impacted, regardless of the host operating system.

The CVSS score of 4.8 indicates a medium severity, and the EPSS score is not available, suggesting no publicly known exploit currently. The vulnerability is listed as not in CISA KEV, and no exploit reference is cited. Attackers must be able to provide a crafted FileVault 2 volume to the application that uses libfvde_volume_open; thus the bypass may be local or remote depending on the application context. Given the lack of a publicly available exploit, the immediate risk is moderate but the information leakage potential warrants prompt mitigation.