CVE-2026-120454

Description

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: MEDIUM
CVSS score: 6.8 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Effective score: 6.8 / 10 MEDIUM source: CNA overview
CWE(s): CWE-476
Reserved: 2026-11-02
Published: 2026-11-02 14:29 UTC
Last updated: 2026-11-02 14:29 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120454.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-115214

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
The Sleuth Kit	The Sleuth Kit	`0` (affected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

https://github.com/sleuthkit/sleuthkit/issues/3583 issue-tracking
https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169 technical-description
The Sleuth Kit sleuthkit-4.15.0 Release Notes release-notes
https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read technical-description
VulnCheck Advisory: The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVE-2026-120454 - Vulnerability Details - OpenCVE

web:app.opencve.io

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr () that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.

2026-11-03 12:35 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-03 12:35 UTC
CVE-2026-120454 - Exploits & Severity - Feedly

web:feedly.com

CVE ID : CVE-2026-120454 Published : Nov. 2, 2026 , 2:29 p.m. 37 minutes ago Description : The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr () that allows attackers to crash the tool by supplying a crafted HFS+ image.

2026-11-03 12:35 UTC
NVD - Search

web:nvd.nist.gov

Search Please make use of the interactive search interfaces to find information in the database!

2026-11-03 12:35 UTC
CVE-2026-120454 - NULL Pointer Dereference in The Sleuth Kit…

web:vulmon.com

NULL Pointer Dereference in The Sleuth Kit Through 4.15.0 via Crafted HFS+ Image. The Sleuth Kit versions up to and including 4.15.0 are affected by a NULL…

2026-11-03 12:35 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.

2026-11-03 12:35 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-03 12:35 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-11-03 12:35 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-03 12:35 UTC
CVE-2026-120454: The Sleuth Kit: The Sleuth Kit through 4.15.0 ... - Rapid7

web:www.rapid7.com

CVE-2026-120454 : The Sleuth Kit: The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr () that…. View severity, references, and remediation details from Rapid7.

2026-11-03 12:35 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120454.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/sleuthkit/sleuthkit",
          "product": "The Sleuth Kit",
          "repo": "https://github.com/sleuthkit/sleuthkit",
          "vendor": "The Sleuth Kit",
          "versions": [
            {
              "lessThanOrEqual": "4.15.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.15.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T14:29:11.639Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/issues/3583"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169"
        },
        {
          "name": "The Sleuth Kit sleuthkit-4.15.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read"
        },
        {
          "name": "VulnCheck Advisory: The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression"
        }
      ],
      "title": "The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120454",
    "datePublished": "2026-11-02T14:29:11.639Z",
    "dateReserved": "2026-11-02T12:42:21.444Z",
    "dateUpdated": "2026-11-02T14:29:11.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}