CVE-2026-120454— The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

Quick assessment

Affected

The Sleuth Kit The Sleuth Kit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sleuth Kit 4.15.0 及之前版本在函数中存在空指针解引用漏洞。攻击者可通过提供特制的 HFS+ 镜像文件触发该漏洞，导致工具崩溃。具体而言，攻击者可在 LZVN 内联的属性中设置一个极大的值，致使内存分配失败，随后解码器向空指针写入数据，从而引发拒绝服务（DoS）攻击。

CVSS 5.5 · Medium EPSS 0.12% · P2 Updated Nov 02, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

Vendor	Product	Version Range	Status
The Sleuth Kit	The Sleuth Kit	`≤ 4.15.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

Source: CVE Program / CVE List V5

Vulnerability Description

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
The Sleuth Kit	The Sleuth Kit	0 ~ 4.15.0	-

II. Public POCs for CVE-2026-120454

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120454

请登录查看更多情报信息。

Other References for CVE-2026-120454 (5)

https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169 technical-description
https://github.com/sleuthkit/sleuthkit/issues/3583 issue-tracking
https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read technical-description
https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0 release-notes
https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120454

IV. Related Vulnerabilities

Same product: The Sleuth Kit

Same vendor: The Sleuth Kit

Same weakness: CWE-476