CVE-2026-120454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120454", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-02T12:42:21.444Z", "datePublished": "2026-11-02T14:29:11.639Z", "dateUpdated": "2026-11-05T21:44:51.763Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:11.639Z"}, "datePublic": "2026-10-21T00:00:00.000Z", "title": "The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression", "descriptions": [{"lang": "en", "value": "The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "NULL Pointer Dereference", "cweId": "CWE-476", "type": "CWE"}]}], "affected": [{"vendor": "The Sleuth Kit", "product": "The Sleuth Kit", "packageURL": "pkg:github/sleuthkit/sleuthkit", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.15.0", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/sleuthkit/sleuthkit"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.15.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/sleuthkit/sleuthkit/issues/3583", "tags": ["issue-tracking"]}, {"url": "https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169", "tags": ["technical-description"]}, {"url": "https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0", "tags": ["release-notes"], "name": "The Sleuth Kit sleuthkit-4.15.0 Release Notes"}, {"url": "https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-120453-120454-sleuthkit-hfs-decmpfs-attr-oob-read", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:44:10.659258Z", "id": "CVE-2026-120454", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:44:51.763Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120454", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:44:10.659258Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-120453-120454-sleuthkit-hfs-decmpfs-attr-oob-read", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:44:40.375Z"}}], "cna": {"title": "The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/sleuthkit/sleuthkit", "vendor": "The Sleuth Kit", "product": "The Sleuth Kit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.15.0"}], "packageURL": "pkg:github/sleuthkit/sleuthkit", "defaultStatus": "unaffected"}], "datePublic": "2026-10-21T00:00:00.000Z", "references": [{"url": "https://github.com/sleuthkit/sleuthkit/issues/3583", "tags": ["issue-tracking"]}, {"url": "https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169", "tags": ["technical-description"]}, {"url": "https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0", "name": "The Sleuth Kit sleuthkit-4.15.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression", "name": "VulnCheck Advisory: The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.15.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:11.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120454", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:44:51.763Z", "dateReserved": "2026-11-02T12:42:21.444Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T14:29:11.639Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/sleuthkit/sleuthkit", "product": "The Sleuth Kit", "repo": "https://github.com/sleuthkit/sleuthkit", "vendor": "The Sleuth Kit", "versions": [{"lessThanOrEqual": "4.15.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service."}], "id": "CVE-2026-120454", "lastModified": "2026-11-05T22:17:54.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120454", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:44:10.659258Z", "version": "2.0.3"}}]}, "published": "2026-11-02T15:17:28.950", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/sleuthkit/sleuthkit/issues/3583"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/cve-2026-120453-120454-sleuthkit-hfs-decmpfs-attr-oob-read"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sleuthkit: sleuthkit: Denial of Service via crafted HFS+ image", "id": "2567943", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567943"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.", "A flaw was found in sleuthkit. An attacker can cause a Denial of Service (DoS) by providing a specially crafted HFS+ filesystem image with an excessively large uncompressed attribute size. When sleuthkit attempts to decompress the data, a memory allocation failure triggers a null pointer dereference, causing the application to crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-120454", "public_date": "2026-11-02T14:29:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120454\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120454\nhttps://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169\nhttps://github.com/sleuthkit/sleuthkit/issues/3583\nhttps://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0\nhttps://hackmd.io/@haindpwn/cve-2026-120453-120454-sleuthkit-hfs-decmpfs-attr-oob-read\nhttps://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read\nhttps://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression"], "statement": "This vulnerability is rated as Moderate severity because successful exploitation requires an investigator or automated pipeline to process an untrusted HFS+ disk image, with the impact confined strictly to an application crash. Sleuthkit operates primarily as an on-demand forensic command-line utility and analysis library rather than a persistent background service, meaning termination of the process does not compromise system integrity, expose confidential data, or disrupt the host operating system. Environments that do not inspect untrusted HFS+ file systems or disk images remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.15.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "The Sleuth Kit", "source": "cna", "vendor": "The Sleuth Kit"}, "product": "the_sleuth_kit", "vendor": "sleuthkit"}], "created": "2026-11-02T15:45:17.788134+00:00", "updated": "2026-11-02T16:00:09.817770+00:00", "vendors": ["sleuthkit", "sleuthkit$PRODUCT$the_sleuth_kit"]}