QEMU DMG reader leaked heap data on short LZFSE streams

QEMU's reader for Apple DMG disk images could disclose heap contents when a chunk claimed to be LZFSE-compressed decoded short of the expected size. Julio Faracco posted a fix for the flaw, tracked as CVE-2026-116483, along with a regression test.

DMG is the container macOS uses for disk images, and QEMU opens those images directly for guests and for conversion. LZFSE is one of the compressors Apple uses inside them. On a short stream the decoder finished without filling the whole output buffer, and the unread tail was never cleared. Anything already sitting in that memory could then be returned as if it were part of the disk image. A crafted image was enough; the reader did not need a successful full decompress to hand the leftover bytes back.

The fix gives the decompressor one extra byte of room, allocated when the image is opened, so a decode that lands exactly on the chunk size can be told apart from one that stops early or overruns. Short and oversized streams are rejected with an I/O error instead of being treated as valid image data. A new I/O test builds a DMG with a deliberately short LZFSE stream and checks that a read fails rather than returning the unfilled tail.

Anyone who lets QEMU open DMGs from untrusted sources was exposed until the change lands. Images that decode to the full chunk size are unaffected.