CVE-2026-40025 Details
Description
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.
A vulnerability allowing out-of-bounds read has been identified in The Sleuth Kit versions through 4.14.0. This issue resides in the APFS filesystem keybag parser, where the 'wrapped_key_parser' class improperly handles length fields controlled by attackers, leading to unauthorized heap reads beyond the allocated buffer. An attacker could create a malicious APFS disk image that, when processed by any Sleuth Kit tool that analyzes APFS volumes, could cause information disclosure or a crash.
Users can upgrade to The Sleuth Kit version 4.14.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sleuthkit/sleuthkit/commit/8b9c9e7d493bd68624f3b1a3963edd45c3ff7611 | [email protected] | Patch |
| https://github.com/sleuthkit/sleuthkit/pull/3444 | [email protected] | Issue Tracking |
| https://mobasi.ai/sentinel | [email protected] | Third Party Advisory |
| https://www.vulncheck.com/advisories/sleuth-kit-apfs-keybag-parser-out-of-bounds-read | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sleuthkit the sleuth kit | < 4.15.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Reanalysis | [email protected] |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | New CVE Received | [email protected] |