CVE-2026-40025: Sleuth Kit APFS Information Disclosure

CVE-2026-40025 Overview

The Sleuth Kit through version 4.14.0 contains an out-of-bounds read vulnerability (CWE-125) in the APFS filesystem keybag parser. The wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.

Critical Impact

Malicious APFS disk images can cause information disclosure through heap memory leaks or denial of service via application crashes when processed by forensic tools built on The Sleuth Kit library.

Affected Products

• The Sleuth Kit through version 4.14.0
• Forensic tools and applications built on The Sleuth Kit library with APFS parsing capabilities
• Any software utilizing The Sleuth Kit's APFS keybag parser functionality

Discovery Timeline

• April 8, 2026 - CVE-2026-40025 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40025

Vulnerability Analysis

This vulnerability resides in The Sleuth Kit's APFS filesystem keybag parser component. The core issue stems from improper validation of length fields within the wrapped_key_parser class when processing APFS disk images. When the parser encounters length values embedded in the disk image data, it follows these attacker-controlled values without performing adequate bounds checking against the actual allocated buffer size.

The vulnerability allows an attacker to craft a specially malformed APFS disk image where the embedded length fields specify sizes larger than the actual data buffers. When a Sleuth Kit tool processes such an image, the parser attempts to read beyond the boundaries of allocated heap memory, resulting in either information disclosure (if the out-of-bounds data can be retrieved) or application crashes.

Root Cause

The root cause is missing bounds validation in the wrapped_key_parser class within tsk/fs/tsk_apfs.hpp. The parser trusts length fields from the APFS disk image without verifying that the specified length falls within the boundaries of the allocated buffer. This is a classic instance of CWE-125 (Out-of-bounds Read) where user-controlled input directly influences memory read operations without proper sanitization.

Attack Vector

The attack requires local access and user interaction - a victim must process a maliciously crafted APFS disk image using a Sleuth Kit-based tool. The attacker creates a disk image with manipulated length fields in the keybag structure. When the image is analyzed with tools like fls, mmls, icat, or autopsy, the vulnerable parser reads past heap boundaries.

The security patch introduces an APFS_sized_key_data structure that tracks buffer size alongside the data pointer, ensuring length validation is always performed:

 
class APFSPool;

+// An owning buffer that also carries its own length, so callers never need to
+// track the size separately. Drop-in replacement for unique_ptr<uint8_t[]>
+// at call sites — supports operator bool() and .get() for compatibility.
+struct APFS_sized_key_data {
+  std::unique_ptr<uint8_t[]> ptr;
+  size_t                     size{0};
+
+  // Allows `if (data)` / `if (!data)` checks to keep working.
+  explicit operator bool() const noexcept { return ptr != nullptr; }
+
+  // Mimic unique_ptr's .get() so existing call sites need minimal changes.
+  const uint8_t* get() const noexcept { return ptr.get(); }
+};



class APFSObject : public APFSBlock {
 protected:
  inline const apfs_obj_header *obj() const noexcept {

Source: GitHub Commit Update

Detection Methods for CVE-2026-40025

Indicators of Compromise

• Unexpected crashes of Sleuth Kit tools (fls, mmls, icat, fsstat) when processing APFS disk images
• Segmentation faults or memory access violations in forensic workstation logs during APFS analysis
• Core dumps from Sleuth Kit-based applications containing evidence of heap boundary violations

Detection Strategies

• Monitor forensic workstations for abnormal Sleuth Kit process terminations when handling APFS volumes
• Implement file integrity checks on APFS disk images before processing with forensic tools
• Deploy application crash monitoring to detect exploitation attempts against forensic infrastructure

Monitoring Recommendations

• Log all disk image processing activities with source tracking for forensic chain of custody
• Enable core dump analysis on systems running Sleuth Kit tools to identify exploitation attempts
• Review incoming disk images from untrusted sources with sandboxed analysis environments

How to Mitigate CVE-2026-40025

Immediate Actions Required

• Upgrade The Sleuth Kit to a version newer than 4.14.0 that includes the security patch
• Avoid processing APFS disk images from untrusted sources until patching is complete
• Run Sleuth Kit tools in isolated or sandboxed environments when analyzing potentially malicious media

Patch Information

The vulnerability has been addressed through GitHub Pull Request #3444 which introduces the APFS_sized_key_data structure to enforce bounds checking during keybag parsing. The fix ensures that buffer size is tracked alongside data pointers, preventing out-of-bounds reads. The specific patch is available in commit 8b9c9e7.

For additional technical details, refer to the VulnCheck Advisory on Sleuth Kit.

Workarounds

• Process untrusted APFS disk images in isolated virtual machines or containers to limit impact of exploitation
• Use memory-safe wrappers or AddressSanitizer when running Sleuth Kit tools on suspicious media
• Implement pre-screening of APFS images with structure validation tools before forensic analysis

# Run Sleuth Kit tools in a sandboxed environment
# Example using firejail for isolation
firejail --net=none --private-tmp fls -r -o 12345 suspicious_apfs.dmg

# Or use Docker for containerized analysis
docker run --rm -v /evidence:/evidence:ro sleuthkit-container fls -r -o 12345 /evidence/suspicious_apfs.dmg