The Sleuth Kit versions up to 4.15.0 contain a NULL pointer dereference in the decmpfs_decompress_lzvn_attr function. An attacker can supply a crafted HFS+ image with an exaggerated uncompressed_size in an LZVN inline com.apple.decmpfs attribute. This forces the decoder to allocate memory, the allocation fails, and the code writes through a NULL pointer, crashing the tool. The result is a local denial of service that may interrupt forensic investigations and any other processes that depend on the tool.

The Sleuth Kit, all releases up to and including 4.15.0. The vulnerability is present in the core decmpfs_decompress_lzvn_attr routine that is used when parsing HFS+ file system images.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation in the wild is unclear. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires the attacker to supply a malicious HFS+ image that the tool will process, a scenario that is plausible in environments where the Sleuth Kit is used on untrusted media. The denial of service outcome limits the availability of the forensic tool but does not directly expose data to an attacker.