Live › vulnerability › CVE-2026-120454
The Sleuth Kit through 4.15.0 has a NULL pointer dereference in the LZVN decompression of HFS+ com.apple.decmpfs attributes. A crafted disk image with a huge uncompressed size makes the tool crash, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Only installations of The Sleuth Kit through 4.15.0 that parse HFS+ disk images, typically digital forensics or incident response workstations and automated analysis pipelines. Systems that only process trusted or non-HFS+ images are unlikely to be reached. The impact is a crash, not code execution, as described in the sources.
No product ranges from the sources yet.
tsk_gettimes -V or fls -V and compare it to the fixed release in the sources4.15.0 (the fixed version is listed in the release notes linked in the sources; the exact number is unknown here)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-120454")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.