CVE-2026-120453— The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

Quick assessment

Affected

The Sleuth Kit The Sleuth Kit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sleuth Kit 4.15.0 及更早版本在文件的函数中存在堆越界读取漏洞。该漏洞源于在读取 decmpfs 头部时未对属性长度进行检查。攻击者可构造一个 HFS+ 镜像，将属性的值设置为 1 至 15，从而读取超出分配内存的区域，导致或等分析工具崩溃。

CVSS 3.3 · Low Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

Source: CVE Program / CVE List V5

Vulnerability Description

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
The Sleuth Kit	The Sleuth Kit	0 ~ 4.15.0	-

II. Public POCs for CVE-2026-120453

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120453

请登录查看更多情报信息。

Other References for CVE-2026-120453 (5)

https://github.com/sleuthkit/sleuthkit/issues/3583 issue-tracking
https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/hfs.c#L4249-L4318 technical-description
https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read technical-description
https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0 release-notes
https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-heap-out-of-bounds-read-via-hfs-decmpfs-header third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120453

IV. Related Vulnerabilities

Same product: The Sleuth Kit

Same vendor: The Sleuth Kit

Same weakness: CWE-125