CVE-2026-120453: The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.