Live › vulnerability › CVE-2026-120453
The Sleuth Kit forensic toolkit reads past a heap allocation when parsing extended attributes in a crafted HFS+ disk image. An attacker who supplies such an image can crash analysis tools like istat or icat.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams that run The Sleuth Kit on untrusted disk images, such as forensic or incident-response analysts processing HFS+ evidence from unknown sources. The sources describe a crash (denial of service) rather than code execution. Teams that only analyze images they trust can likely skip it.
No product ranges from the sources yet.
tsk_version or istat -V to see the installed Sleuth Kit version4.15.0 or earlierNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.
This page as .md · .json · in your agent: get_signal("CVE-2026-120453")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.