The vulnerability resides in the APFS keybag parser within Sleuth Kit versions up to 4.14.0. An attacker can supply an APFS disk image that contains crafted length fields; the wrapped_key_parser routine follows these fields without performing bounds checking, resulting in a heap read that exceeds the allocated buffer. The read can expose data beyond the intended scope or cause the processing tool to crash. This type of flaw is categorized as CWE‑125 (Out‑of‑Bounds Read).

Sleuth Kit, the open‑source digital forensics framework, is affected when processing APFS volumes. All versions of the Sleuth Kit up to and including 4.14.0 that provide APFS keybag parsing functionality are vulnerable; newer releases may have addressed the issue. Users running any Sleuth Kit tools that analyze APFS volumes on untrusted or potentially malicious disk images are at risk.

The CVSS score of 4.8 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation. The attack vector requires an attacker-controlled APFS disk image to be processed by the tool; therefore, exposure generally occurs when individuals or automated workflows ingest malicious or compromised disk images. Prompt patching mitigates the risk, as the flaw cannot be partially mitigated by configuration alone.