UBUNTU-CVE-2026-120453: Medium severity ubuntu/sleuthkit vulnerability
Published Nov 3, 2026
·Updated
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.
Affected Software
8 affected components
ubuntu/sleuthkit*
ubuntu/sleuthkit*
ubuntu/sleuthkit*
ubuntu/sleuthkit*
ubuntu/sleuthkit*
ubuntu/sleuthkit*
ubuntu/sleuthkit*
ubuntu/sleuthkit*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which environments are exposed to this issue?
Systems using Sleuth Kit to analyze HFS+ filesystem images are exposed when they process a crafted image. Tools such as istat and icat can crash while handling the malformed filesystem metadata.
2
What must an attacker do to trigger the vulnerability?
An attacker must provide a crafted HFS+ image containing a com.apple.decmpfs extended attribute with an attr_size from 1 to 15. A user or analyst must then process that image with an affected analysis tool.