The vulnerability resides in the ISO9660 filesystem parser of Sleuth Kit versions up to 4.14.0. The parse_susp() routine accepts len_id, len_des, and len_src values from the disk image and copies that many bytes into a stack buffer without validating that the source data is within the parsed SUSP block. An attacker can supply a malicious ISO image that makes the routine read past the end of the buffer and can also inject a zero‑length SUSP entry that results in an infinite parsing loop. The result is an out‑of‑bounds read, possible disclosure of nearby memory, and a crash or denial of service. This falls under the CWE‑125 category of out‑of‑bounds read.

The affected product is Sleuth Kit from the sleuthkit organization. Versions up to and including 4.14.0 are impacted. Users should refer to the commit a95b0ac and the pull request 3445 that contain the fix.

The CVSS score is 4.8, indicating a moderate risk. The EPSS score is not provided, so the likelihood of exploitation remains unclear, but the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. Since the flaw can be triggered by a crafted ISO image, it requires local access or the ability to supply an ISO to the target system. An attacker could cause the system running Sleuth Kit to hang or crash, but there is no evidence of remote code execution or data exfiltration. The attack vector is inferred to be local file processing.