CVE-2026-107634 in Dislocker
Summary
by MITRE • 10/08/2026
Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Dislocker versions through 0.7.3 represents a critical security flaw rooted in improper input validation within the core data processing functions get_dataset and get_next_datum. These specific routines are responsible for parsing metadata structures from BitLocker volume images to retrieve dataset information and individual datum entries during the decryption or mounting process. The fundamental technical error lies in the failure of these functions to validate the declared sizes of datasets and datums against the actual allocated size of the underlying metadata buffer. This lack of boundary checking creates a classic heap out-of-bounds read condition, where the application attempts to access memory locations that lie beyond the intended allocation limits defined by the file structure specifications.
From an operational perspective, this flaw allows attackers who possess control over or can influence the BitLocker volume image being processed to exploit the vulnerability in two distinct ways depending on the system state and compiler optimizations. The most immediate impact is a denial of service scenario where opening or mounting a crafted volume causes Dislocker to crash due to accessing invalid memory addresses. This disrupts availability for users attempting to access encrypted data through this utility. More severely, if the out-of-bounds read occurs in a manner that allows the application to continue execution without immediately terminating, it can lead to sensitive information disclosure. By crafting images with inflated size fields, an attacker can force Dislocker to leak adjacent heap memory contents into the output stream or internal variables, potentially exposing cryptographic keys, user data from other processes, or system configuration details stored in nearby memory blocks.
This vulnerability aligns closely with Common Weakness Enumeration CWE-125, which describes out-of-bounds read errors resulting from insufficient validation of array indices or buffer sizes before access operations. The exploitation technique also maps to the MITRE ATT&CK framework under techniques related to unauthorized data access and potentially privilege escalation if combined with other vulnerabilities in a broader attack chain. Specifically, it falls under patterns associated with memory corruption attacks where an attacker manipulates input parameters to bypass intended security boundaries defined by the software architecture.
Mitigation strategies for this vulnerability primarily involve updating Dislocker to version 0.7.4 or later, where these validation checks have been implemented in both get_dataset and get_next_datum functions. Until such updates are available, administrators should restrict access to untrusted BitLocker volume images and avoid using Dislocker with files sourced from unknown or potentially malicious actors. Additionally, employing memory protection mechanisms such as Address Space Layout Randomization (ASLR) can mitigate the impact of information disclosure by making it harder for attackers to predict the location of sensitive data in heap memory, although this does not prevent the crash associated with denial-of-service conditions.