CVE-2026-40025: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-40025 is an out-of-bounds read vulnerability in The Sleuth Kit's APFS filesystem keybag parser, affecting versions through 4.14.0. The wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. It was reported by Mobasi, patched on March 1, 2026 (commit merged), and publicly disclosed on April 8–9, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-805 (Buffer Access with Incorrect Length Value). In the vulnerable code, the wrapped_key_parser constructor accepted only a raw data pointer with no associated size, and the get_length() method consumed attacker-controlled TLV length fields without verifying they remained within the allocated buffer — enabling heap reads past the buffer boundary. The fix introduced an _end pointer (one-past-the-end sentinel), added an is_eob() bounds-checking helper, and changed the constructor signature to require an explicit size parameter; the get_key() return type was also changed from std::unique_ptr to a new APFS_sized_key_data struct that carries the buffer length alongside the pointer. Exploitation requires a user or automated tool to process a specially crafted APFS disk image (Github Commit, Github Advisory).

Successful exploitation can result in limited information disclosure — heap memory contents read past the allocated buffer may be exposed — or a denial-of-service crash of the Sleuth Kit tool processing the malicious image. The vulnerability affects any Sleuth Kit tool that parses APFS volumes (e.g., fls, icat, mmls), which are commonly used in digital forensics workflows and automated disk analysis pipelines. There is no integrity impact and no evidence of lateral movement potential; the scope is limited to the vulnerable process (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a user or automated process must open or process a malicious APFS disk image — limiting the attack surface (Github Advisory).

1. Craft a malicious APFS disk image: Create an APFS-formatted disk image with a specially crafted keybag structure where TLV (Tag-Length-Value) length fields in the keybag data are set to values larger than the actual allocated buffer, exploiting the missing bounds check in wrapped_key_parser.
2. Deliver the image to the target: Provide the malicious disk image to a user or system that will process it with a Sleuth Kit tool (e.g., via email attachment, shared storage, or as part of a forensic evidence submission).
3. Trigger APFS parsing: The target runs a Sleuth Kit tool (such as fls, icat, or mmls) against the malicious image, causing the tool to parse the APFS volume and invoke the vulnerable wrapped_key_parser code path.
4. Trigger out-of-bounds read: The parser follows the attacker-controlled length field without bounds checking, reading heap memory past the end of the allocated buffer. Depending on heap layout, this may expose sensitive memory contents (information disclosure) or cause a crash (denial of service) (Github Commit, Github Advisory).

• File System: Presence of unexpected or externally sourced APFS disk image files (.dmg, .img, .raw) in directories processed by Sleuth Kit tools.
• Process: Sleuth Kit processes (e.g., fls, icat, mmls, tsk_recover) terminating abnormally with segmentation faults or heap corruption errors when processing APFS volumes.
• Logs: Application crash logs or core dumps referencing Sleuth Kit binaries with stack traces involving wrapped_key_parser, get_length, or get_tag functions in apfs.cpp; system logs showing repeated abnormal exits of forensic analysis tools.

Update The Sleuth Kit to a version newer than 4.14.0 that includes the security fix introduced in commit 8b9c9e7 (merged March 1, 2026 into the develop-4.14 branch). As a workaround until patching is complete, avoid processing untrusted or externally sourced APFS disk images with Sleuth Kit tools. Organizations using downstream packages (e.g., Red Hat, NixOS, osquery) should monitor their respective package repositories for updated builds (Github Commit, Github Advisory, Red Hat Bugzilla).

The vulnerability was reported to the Sleuth Kit maintainers by Mobasi (via their Sentinel security research platform) and fixed promptly by project maintainer bcarrier. A contributor (joachimmetz) noted on the pull request that multiple similar unaddressed issues exist in the APFS code, including use-after-free and null-dereference bugs (tracked in issues #2641 and #2625), suggesting broader quality concerns in the APFS parser. The vulnerability was also flagged in the osquery project as a dependency concern (Github PR).