---
id: "CVE-2026-120454"
kind: "vulnerability"
aliases: ["CVE-2026-120454"]
title: "The Sleuth Kit: crafted HFS+ image crashes the forensic tool"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["forensics", "hfs+", "macos-images", "package", "sleuth-kit"]
not_affected_if: ["no-hfs-images", "trusted-images-only", "version-above-4.15.0"]
published_at: "2026-11-02T15:17:28+00:00"
first_seen_at: "2026-11-02T15:24:03+00:00"
updated_at: "2026-11-02T15:26:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120454", "first_seen_at": "2026-11-02T15:24:03+00:00"}]
---

# The Sleuth Kit: crafted HFS+ image crashes the forensic tool

The Sleuth Kit through 4.15.0 has a NULL pointer dereference in the LZVN decompression of HFS+ com.apple.decmpfs attributes. A crafted disk image with a huge uncompressed size makes the tool crash, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `tsk_gettimes -V` or `fls -V` and compare it to the fixed release in the sources
- Confirm whether the tool is run on HFS+ images from untrusted sources

## Fix

- Move to a release newer than `4.15.0` (the fixed version is listed in the release notes linked in the sources; the exact number is unknown here)

## Timeline

- 2026-11-02T15:24:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120454

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression
- [fix] Release notes: github.com https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0

## From the sources

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_