CVE-2026-120454: The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

Published Nov 2, 2026

Updated

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

Affected Software

8 affected components

ubuntu/sleuthkit*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

Data Sourced

via OSV·12:00 AM

Affected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Users of The Sleuth Kit through 4.15.0 are exposed when they process attacker-supplied or otherwise untrusted HFS+ images containing LZVN inline com.apple.decmpfs attributes.

What does an attacker need to do to trigger the crash?

The attacker must provide a crafted HFS+ image with an LZVN inline com.apple.decmpfs attribute whose uncompressed_size is set to a huge value. This can cause allocation failure followed by a NULL-pointer write in the decoder, crashing the tool.

CVE-2026-120454: The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the crash?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the crash?