CVE-2026-107635

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107635
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107635.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107635
Downstream
Published
2026-10-08T14:10:33Z
Modified
2026-10-28T10:46:03Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow
Details

Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datum_size smaller than the 36-byte AES-CCM header, causing hexdump() to over-read and crash dislocker.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-191"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107635.json"
}
References

Affected packages

Git / github.com/aorimn/dislocker

Affected ranges

Type
GIT
Repo
https://github.com/aorimn/dislocker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0706462db88efe8df88150e4c3e4332b808f4581
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.7.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "0706462db88efe8df88150e4c3e4332b808f4581"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.3
v0.4
v0.4.1
v0.5
v0.5.1
v0.5.2
v0.6
v0.6.1
v0.7
v0.7.1
v0.7.2
v0.7.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107635.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "276617739016411096522570655449759205805",
            "length":  506
        },
        "id":  "CVE-2026-107635-110ec8b0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "rb_datum_aes_ccm_to_s"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "218114695084867712436201521956314476329",
            "length":  407
        },
        "id":  "CVE-2026-107635-1116e746",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "rb_datum_tpmenc_to_s"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "221818108949582322161352342469901674641",
            "length":  1699
        },
        "id":  "CVE-2026-107635-16e9c7ee",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/fvek.c",
            "function":  "get_fvek"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "86939952404962424110451902250417551205",
            "length":  248
        },
        "id":  "CVE-2026-107635-260ac0b1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "print_datum_generic"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "177386367861562744974404083392704671266",
            "length":  405
        },
        "id":  "CVE-2026-107635-2a59488a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "print_datum_unicode"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "96592530847269042892524845579120992812",
            "length":  519
        },
        "id":  "CVE-2026-107635-339b486a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "rb_datum_key_to_s"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "102446119138033566907698548511897654332",
            "length":  380
        },
        "id":  "CVE-2026-107635-4a4930b9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "print_datum_aes_ccm"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "51245620099099411641450004019415842033",
                "228171504721186230948769051538256224272",
                "203601461236801520491758242246816649989",
                "203360571357062528571166470468459788535",
                "53107847403106082922867855093951672539"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107635-5f42f1cb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/fvek.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "91895565873511701930950305485670346015",
            "length":  329
        },
        "id":  "CVE-2026-107635-5fc6f7a0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "rb_datum_generic_to_s"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "14498387969153751424644869648040306001",
                "95964915797507908928469204301232392896",
                "43319194338884485521393801766282037256",
                "204080367014718088367716658259366753021",
                "7653727952025013526720845029373273286",
                "31289543369339493961501535123448749873",
                "177687263775968342825003136840824619812",
                "6859089552225542992912805548142229129",
                "142531238926194173289373866944854476162",
                "329662999561666742464894496757635054695",
                "5963596774580726593497339009453831232",
                "266438709416149482012630655158435119031",
                "87138542249563644182054049206855694804",
                "110164649677344884828431083200684319899",
                "162482535732053802553694736926142000560",
                "322473245794168261281625293186077651271",
                "284227332992567311773488281567426420153",
                "304959273331152268430681194189608015087",
                "171739825553727755789030057701178892579",
                "4061645385097497193061507758384626962",
                "249251164695563031536703845247900724976",
                "143746419441940337657649673042915553091",
                "127959118532705305664345750209199832543",
                "67646204250902915342875156708602410555",
                "86395743909176243439798508947952659546",
                "314099919887242006976127907170063028536",
                "160670407206055464600287987250577619238",
                "37044192484802409994533261656751708598",
                "273873190636962849321944972810941741006",
                "135695694113120888745654822532256416919",
                "288946773219830351454996399390793908868",
                "154818955589148840446267113477087591624",
                "93992884126924416380481927025481100519",
                "195370309435160788566129318271749954420",
                "69392597214711041813220581488672805323",
                "96113620458570381851275039561197003121",
                "178211471626485271645933609824695793326",
                "140177091483112683892027510668867709370",
                "141342874718295701657597194732791209546",
                "28378039942521605059093335326280565823",
                "221179879511912224001750548018400717174",
                "304947803425027720729464178756536341659",
                "315148345605204238778055096988561993455",
                "171686090580097633120853513632085627244",
                "249251164695563031536703845247900724976",
                "143746419441940337657649673042915553091",
                "127959118532705305664345750209199832543",
                "67646204250902915342875156708602410555",
                "86395743909176243439798508947952659546",
                "17705308189551787053211756790916953191",
                "181184102617243405696037246727106650709",
                "230317706188846881441269285291029365401",
                "321028057983621844098306253593590483512",
                "39043041479245048024346762149752108226",
                "240793820856556961430608644265387651791",
                "158851921761072002855930222668167961334",
                "70336176642996106223089733031919410584"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107635-67b609e3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "318629386639613805722073320873930069587",
            "length":  461
        },
        "id":  "CVE-2026-107635-9b30732a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "print_datum_key"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "110144244679815910858184266870793336452",
            "length":  527
        },
        "id":  "CVE-2026-107635-9f991be6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "get_payload_safe"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "278782330715932773871393205565122367170",
                "107652797180799963109871711079582592078",
                "224084028314696428013167879269289261639",
                "300044068590550117527907802208719882626"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107635-a801cd52",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/vmk.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "48857670154313272416762024182000783531",
            "length":  1615
        },
        "id":  "CVE-2026-107635-b692daf8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/vmk.c",
            "function":  "get_vmk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "140354591993261707813299484127951892109",
            "length":  299
        },
        "id":  "CVE-2026-107635-b7a601f0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "print_datum_tpmenc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "281532721271900807205482294880404205985",
            "length":  504
        },
        "id":  "CVE-2026-107635-fb118e06",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581",
        "target":  {
            "file":  "src/metadata/datums.c",
            "function":  "rb_datum_unicode_to_s"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:46:03Z"