Description
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.
Published: 2026-11-02
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Heap out-of-bounds read leading to denial of service
Action: Apply Patch
AI Analysis

Impact

The vulnerability involves a heap out‑of‑bounds read in the function that loads extended attributes for the HFS+ filesystem. An attacker can supply a crafted HFS+ image with a very small com.apple.decmpfs attribute size, causing the tool to read past the intended memory region and crash analysis utilities such as istat or icat. This results in a denial of service to users relying on these forensic tools. The weakness is a classic out‑of‑bounds read (CWE‑125).

Affected Systems

The Sleuth Kit, versions up through 4.15.0, are affected. All installations of the developer’s software package that include the HFS+ support module may be vulnerable when they process tampered HFS+ images.

Risk and Exploitability

With a CVSS score of 4.8 the vulnerability is moderate. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit this vulnerability by crafting a malicious HFS+ image and providing it to any user who runs the affected analysis tools, likely resulting in a crash. The known attack vector is the use of a tampered disk image, which is inferred from the described impact on forensic utilities.

Generated by OpenCVE AI on November 2, 2026 at 15:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest released version of The Sleuth Kit (4.15.1 or later, which contains the fix for the out‑of‑bounds read)
  • If an immediate upgrade is not possible, restrict the execution of the analysis tools to trusted, sandboxed environments and avoid processing unverified HFS+ images
  • Keep the system and the forensic toolchain under continuous monitoring for new advisories or patches addressing this or related security issues

Generated by OpenCVE AI on November 2, 2026 at 15:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.
Title The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header
First Time appeared Sleuthkit
Sleuthkit the Sleuth Kit
Weaknesses CWE-125
CPEs cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:*
Vendors & Products Sleuthkit
Sleuthkit the Sleuth Kit
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Sleuthkit The Sleuth Kit
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-02T15:44:48.397Z

Reserved: 2026-11-02T12:42:21.046Z

Link: CVE-2026-120453

cve-icon Vulnrichment

Updated: 2026-11-02T15:44:40.783Z

cve-icon NVD

Status : Received

Published: 2026-11-02T15:17:28.750

Modified: 2026-11-02T16:17:33.330

Link: CVE-2026-120453

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T16:00:09Z

Weaknesses