Is CVE-2026-40025 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40025 being exploited in the wild.

How severe is CVE-2026-40025?

Medium severity, with a CVSS score of 4.4, published 8 April 2026.

Which products and versions are affected?

Sleuth Kit The Sleuth Kit through 4.14.0.

Is there a fix for CVE-2026-40025?

A patch was published on 2026-02-28: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40025 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40025?

Check whether you run Sleuthkit The Sleuth Kit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40025: Sleuth Kit out-of-bounds read in APFS keybag parser

CVE-2026-40025 · Severity: medium · CVSS 4.4 · Published 2026-04-08

The Sleuth Kit, a widely used digital forensics library for analyzing disk images, contains a flaw in how it processes Apple File System (APFS) volumes. An attacker can create a specially crafted disk image that, when opened by a forensic investigator using Sleuth Kit tools, causes the software to crash or potentially leak sensitive information from the investigator's computer memory. This could be used to hinder forensic investigations or compromise the integrity of the analysis environment.

Technologies: Sleuthkit The Sleuth Kit. Vendors: Sleuthkit.

Quick answers

Is CVE-2026-40025 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40025 being exploited in the wild.
How severe is CVE-2026-40025?: Medium severity, with a CVSS score of 4.4, published 8 April 2026.
Which products and versions are affected?: Sleuth Kit The Sleuth Kit through 4.14.0.
Is there a fix for CVE-2026-40025?: A patch was published on 2026-02-28: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40025 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40025?: Check whether you run Sleuthkit The Sleuth Kit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in The Sleuth Kit through version 4.14.0 within the APFS filesystem keybag parser. The 'wrapped_key_parser' class fails to perform adequate bounds checking when following length fields provided within the filesystem structures, allowing for heap-based reads beyond the allocated buffer. An attacker can exploit this by providing a malicious APFS disk image to any Sleuth Kit tool (or application utilizing the library) that parses APFS volumes. This can result in a denial-of-service (crash) or the disclosure of sensitive information from the heap. The issue has been addressed in the project's development branch via commit 8b9c9e7.

Affected products

Sleuth Kit The Sleuth Kit through 4.14.0

Timeline

2026-02-28: patched: Fix committed to repository
2026-03-05: disclosed: Initial disclosure by Mobasi Sentinel program
2026-04-08: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.