{"id":"CVE-2026-120454","kind":"vulnerability","aliases":["CVE-2026-120454"],"related":[],"title":"The Sleuth Kit: crafted HFS+ image crashes the forensic tool","description":"The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.","summary":"The Sleuth Kit through 4.15.0 has a NULL pointer dereference in the LZVN decompression of HFS+ com.apple.decmpfs attributes. A crafted disk image with a huge uncompressed size makes the tool crash, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forensics","hfs+","macos-images","package","sleuth-kit"],"not_affected_if":["no-hfs-images","trusted-images-only","version-above-4.15.0"],"how_to_check":"- Check the installed version with `tsk_gettimes -V` or `fls -V` and compare it to the fixed release in the sources\n- Confirm whether the tool is run on HFS+ images from untrusted sources","fix":"- Move to a release newer than `4.15.0` (the fixed version is listed in the release notes linked in the sources; the exact number is unknown here)","status":"open","published_at":"2026-11-02T15:17:28+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","triaged_at":"2026-11-02T15:26:17+00:00","updated_at":"2026-11-02T15:26:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than `4.15.0` (the fixed version is listed in the release notes linked in the sources; the exact number is unknown here)","reach":"local","title":"The Sleuth Kit: crafted HFS+ image crashes the forensic tool","impact":"low","summary":"The Sleuth Kit through 4.15.0 has a NULL pointer dereference in the LZVN decompression of HFS+ com.apple.decmpfs attributes. A crafted disk image with a huge uncompressed size makes the tool crash, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["sleuth-kit","forensics","hfs+","macos-images"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Tool crashes while parsing a crafted HFS+ image, denying service","analyst_note":"","how_to_check":"- Check the installed version with `tsk_gettimes -V` or `fls -V` and compare it to the fixed release in the sources\n- Confirm whether the tool is run on HFS+ images from untrusted sources\n- unknown for anything beyond version","plain_action":"","needs_analyst":false,"not_affected_if":["no-hfs-images","trusted-images-only","version-above-4.15.0"],"who_is_affected":"Only installations of The Sleuth Kit through 4.15.0 that parse HFS+ disk images, typically digital forensics or incident response workstations and automated analysis pipelines. Systems that only process trusted or non-HFS+ images are unlikely to be reached. The impact is a crash, not code execution, as described in the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4219,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120454':13A,16A '-2026':12A,15A '4.15.0':30B,65C 'alloc':104C 'allow':78C 'attack':79C,90C 'attr':76C 'attribut':43B,102C 'caus':57B,112C 'com.apple.decmpfs':42B,101C 'contain':66C 'craft':4A,45B,87C 'crash':7A,56B,81C 'cve':11A,14A 'decmpf':73C 'decod':108C 'decompress':39B,74C 'denial':58B,113C 'derefer':35B,70C 'disk':46B 'fail':105C 'forens':9A,17B 'hfs':5A,18B,41B,88C 'huge':50B,94C 'imag':6A,21B,47B,89C 'inlin':100C 'kit':3A,25B,28B,63C 'lzvn':38B,75C,99C 'maco':20B 'macos-imag':19B 'make':53B 'null':33B,68C,111C 'packag':22B 'pointer':34B,69C 'servic':60B,115C 'set':92C 'size':52B,96C 'sleuth':2A,24B,27B,62C 'sleuth-kit':23B 'suppli':85C 'tool':10A,55B,83C 'uncompress':51B,95C 'vulner':71C 'write':109C","nicknames":[],"mitigations":[],"who_affected":"Only installations of The Sleuth Kit through 4.15.0 that parse HFS+ disk images, typically digital forensics or incident response workstations and automated analysis pipelines. Systems that only process trusted or non-HFS+ images are unlikely to be reached. The impact is a crash, not code execution, as described in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["forensics","hfs","macosimages","medium","package","sleuthkit"],"first_public_at":"2026-11-02T15:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120454","severity":null,"published_at":"2026-11-02T15:17:28+00:00","modified_at":"2026-11-02T15:17:28+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","fetched_at":"2026-11-02T15:24:03+00:00","note":null}],"documents":[{"id":52503,"url":"https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52506,"url":"https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}