CVE-2026-120454

MEDIUM 5.5

The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

CWE	CWE-476
Vendor	the sleuth kit
Product	the sleuth kit
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for the sleuth kit the sleuth kit

Be the first to know when new medium vulnerabilities affecting the sleuth kit the sleuth kit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

The Sleuth Kit / The Sleuth Kit

0 ≤ 4.15.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sleuthkit/sleuthkit/issues/3583 github.com: https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169 github.com: https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0 hackmd.io: https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read vulncheck.com: https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression

Credits

HaiND from the Post and Telecommunication Institute of Technology