CVE-2026-120453 in The Sleuth Kit
Summary
by MITRE • 11/02/2026
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The Sleuth Kit, specifically versions up through 4.15.0, contains a critical heap-based out-of-bounds read vulnerability located within the hfs_load_extended_attrs function in the tsk/fs/hfs.c source file. This flaw arises from an insufficient validation of attribute lengths when processing HFS+ filesystem images. Specifically, the code attempts to load extended attributes but fails to verify that the declared size of a com.apple.decmpfs attribute is sufficient before reading its header data. The vulnerability manifests when an attacker provides a maliciously crafted HFS+ image where the attr_size field for this specific attribute type is set to a value between one and fifteen bytes, which is structurally insufficient for the expected decmpfs header format.
From a technical perspective, the absence of bounds checking allows the application to read memory beyond the allocated buffer associated with the attribute data. This heap out-of-bounds read occurs because the parser assumes that if an extended attribute exists, its size will be adequate to contain the standard header information required for decompression metadata processing. By supplying a truncated or artificially small size value, an attacker forces the reading operation to access adjacent memory regions on the heap. While this specific instance primarily results in a denial of service rather than immediate arbitrary code execution, it represents a significant integrity and availability risk within forensic analysis workflows that rely on accurate parsing of filesystem structures.
The operational impact of this vulnerability is most severe for digital forensics professionals and incident responders who utilize tools built upon The Sleuth Kit, such as Istat and icat. These applications are designed to analyze disk images and extract data from various file systems including HFS+. When a user attempts to open or process a maliciously crafted HFS+ image containing the malformed attribute, the application will likely crash due to accessing invalid memory addresses. This denial of service disrupts forensic investigations by rendering critical tools unusable during active cases. Furthermore, in more complex scenarios where heap metadata is corrupted, such out-of-bounds reads could potentially lead to information disclosure or serve as a precursor for further exploitation techniques targeting memory corruption vulnerabilities.
This vulnerability aligns with Common Weakness Enumeration CWE-125, which describes Out-of-Bounds Read, and can be mapped to the MITRE ATT&CK framework under tactics related to Discovery and Impact, specifically reflecting behaviors associated with Denial of Service via application crashes caused by malformed input data. To mitigate this risk, organizations using The Sleuth Kit should ensure they are running patched versions that include proper length validation checks within the hfs_load_extended_attrs function. Developers must implement strict boundary checking before accessing any attribute data to prevent reading beyond allocated heap memory. Additionally, forensic practitioners should exercise caution when processing untrusted or suspicious disk images and consider utilizing sandboxed environments for initial analysis until all software components are updated to address this specific parsing flaw.