UBUNTU-CVE-2026-120454: Null Pointer Dereference
The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Users or systems that process untrusted HFS+ images with The Sleuth Kit are exposed. An attacker needs to provide a crafted HFS+ image containing an LZVN inline com.apple.decmpfs attribute.
Does exploitation require authentication or elevated privileges?
No privileges are required according to the supplied vector, but user interaction is required. The vulnerable tool must be induced to process the attacker-crafted image.
What is the impact of successful exploitation?
Successful exploitation crashes the tool through a NULL pointer write after an oversized uncompressed_size causes allocation failure. The reported impact is denial of service; no confidentiality or integrity impact is specified.
How can I determine whether my environment is affected?
Check whether the installed Sleuth Kit version is 4.15.0 or earlier and whether it is used to examine HFS+ images from untrusted sources. The vulnerable code path is decmpfs_decompress_lzvn_attr() when handling LZVN inline com.apple.decmpfs attributes.