Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-40025: Sleuth Kit can leak data or crash on APFS images
CVE-2026-40025 · published 7 months ago
Summary
The Sleuth Kit utilities that open Apple APFS disk images may read past the intended memory when given a specially crafted image. This can let an attacker see hidden information or cause the program to stop working. Upgrade to the newest release or avoid opening untrusted APFS images.
What to do
- Update sleuthkit the_sleuth_kit to version 4.14.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | sleuthkit | the_sleuth_kit |
< 4.14.0 cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | sleuthkit | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | sleuthkit | All versions |
| Ubuntu:18.04:LTS | canonical | sleuthkit | All versions |
| Ubuntu:20.04:LTS | canonical | sleuthkit | All versions |
| Ubuntu:22.04:LTS | canonical | sleuthkit | All versions |
| Ubuntu:24.04:LTS | canonical | sleuthkit | All versions |
| Ubuntu:25.10 | canonical | sleuthkit | All versions |
| Debian:11 | debian | sleuthkit | All versions |
| Debian:12 | debian | sleuthkit | All versions |
| Debian:13 | debian | sleuthkit | All versions |
| Debian:14 | debian | sleuthkit | All versions |
| – | sleuthkit | sleuthkit | <= 4.14.0 |
Original advisory text
Sleuth Kit APFS Keybag Parser Out-of-Bounds Read
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.
References
- https://github.com/sleuthkit/sleuthkit/commit/8b9c9e7d493bd68624f3b1a3963edd45c3... Patch
- https://mobasi.ai/sentinel Vendor Advisory
- https://github.com/sleuthkit/sleuthkit/pull/3444 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-40025 Vendor Advisory
- https://www.vulncheck.com/advisories/sleuth-kit-apfs-keybag-parser-out-of-bounds... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40025... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40025 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-40025 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-40025 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published8 Apr 2026
Updated26 Oct 2026
First seen8 Apr 2026
Sources
UBUNTU-CVE-2026-40025 · OSV
CVE-2026-40025 · NVD
DEBIAN-CVE-2026-40025 · OSV
CVE-2026-40025 · MITRE
CVE-2026-40025 · OSV
Track software like this
Free during beta