Read the docs
TI-2026-83846 Aliases CVE-2026-120454GHSA-gr3p-v4fr-f93c

NULL pointer dereference in The Sleuth Kit HFS+ decmpfs decoder

Priority MEDIUM 63CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference in its decmpfs LZVN decompression code, classified as CWE-476. An attacker who supplies a crafted HFS+ image can crash the tool, causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00121 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Sleuth KitThe Sleuth Kitup to 4.15.0—No fix listedCNA
  • The Sleuth Kit VendorThe Sleuth Kit Affected up to 4.15.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for The Sleuth Kit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120454
  2. 2026-11-02 Alias added: GHSA-gr3p-v4fr-f93c
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-05 Priority changed: LOW → MEDIUM
  6. 2026-11-06 Affected versions changed · Red Hat
  7. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-83845 Heap out-of-bounds read in The Sleuth Kit HFS+ extended attributes CVSS 4.0MEDIUM 4.8
  • TI-2019-15968 Integer overflow in Sleuth Kit The Sleuth Kit CVSS 3.1MEDIUM 6.5
  • TI-2007-02709 Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in… CVSS 2.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences