CVE-2026-120454 in The Sleuth Kit
Summary
by MITRE • 11/02/2026
The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The Sleuth Kit is a widely used open-source digital forensics framework designed to analyze disk images and file systems for investigative purposes. Within this toolkit, version 4.15.0 and earlier versions contain a critical memory safety flaw located in the function decmpfs_decompress_lzvn_attr(). This vulnerability specifically affects the handling of Apple’s LZVN compression format within HFS+ volume structures. The core technical issue arises from improper validation of input data prior to memory allocation, leading to a NULL pointer dereference when processing maliciously crafted inputs.
The specific mechanism of exploitation involves an attacker constructing a malformed HFS+ disk image that contains an inline com.apple.decmpfs attribute with an excessively large uncompressed_size value. When the Sleuth Kit processes this attribute, it attempts to allocate memory based on the declared size without first verifying if the allocation will succeed or if the input data is structurally valid. If the system cannot satisfy the massive memory request due to resource constraints or limits, the malloc function returns a NULL pointer instead of a valid memory address. The subsequent code proceeds to write decompressed data through this null reference, triggering an immediate segmentation fault and causing the application to crash.
This vulnerability represents a classic example of CWE-476, which is defined as a NULL Pointer Dereference. It also aligns with CWE-20 regarding Improper Input Validation, as the software fails to adequately sanitize or validate the size parameters before proceeding with resource-intensive operations. From an operational perspective, this flaw results in a Denial of Service condition for users relying on The Sleuth Kit for forensic analysis. Since digital forensics professionals often process untrusted evidence from various sources, encountering such crafted images can disrupt investigations and cause data loss if unsaved work is involved.
The impact extends beyond simple application crashes to potential reliability issues in automated forensic pipelines where the tool might be invoked programmatically without robust error handling wrappers. An attacker who distributes malicious HFS+ images could exploit this weakness to hinder analysis efforts or force system instability during routine examinations of external drives or backup media formatted with Apple’s Hierarchical File System Plus.
Mitigation strategies primarily involve upgrading The Sleuth Kit to a version where the decmpfs_decompress_lzvn_attr function has been patched to include proper null checks and input validation before memory allocation attempts. Developers should implement strict bounds checking on all size fields derived from file system metadata to ensure they fall within expected ranges for the target architecture. Additionally, integrating fuzzing techniques into the development lifecycle can help identify similar edge cases in other parsers within the toolkit. For end-users, it is advisable to use sandboxed environments when analyzing suspicious disk images and to keep forensic tools updated with security patches released by the maintainers.