Read the docs
TI-2026-83845 Aliases CVE-2026-120453GHSA-h27m-mw24-wfwv

Heap out-of-bounds read in The Sleuth Kit HFS+ extended attributes

Priority MEDIUM 55CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read in hfs_load_extended_attrs() that reads the decmpfs header without checking the attribute length (CWE-125). An attacker can supply a crafted HFS+ image with a com.apple.decmpfs attribute size of 1 to 15, which makes a user's analysis read past the allocation and crash tools such as istat or icat.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00231 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Sleuth KitThe Sleuth Kitup to 4.15.0—No fix listedCNA
  • The Sleuth Kit VendorThe Sleuth Kit Affected up to 4.15.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for The Sleuth Kit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120453
  2. 2026-11-02 CISA SSVC decision points changed
  3. 2026-11-02 Priority changed: LOW → MEDIUM
  4. 2026-11-02 Alias added: GHSA-h27m-mw24-wfwv
  5. 2026-11-03 Affected versions changed · Red Hat
  6. 2026-11-03 CVSS score added · Red Hat

References

Other 4

  • TI-2026-83846 NULL pointer dereference in The Sleuth Kit HFS+ decmpfs decoder CVSS 4.0MEDIUM 6.8
  • TI-2019-15968 Integer overflow in Sleuth Kit The Sleuth Kit CVSS 3.1MEDIUM 6.5
  • TI-2007-02709 Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in… CVSS 2.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences