The Sleuth Kit CVE-2026-120453

Exploitation requires a victim analyst to run a Sleuth Kit tool (e.g., istat or icat) against an attacker-supplied HFS+ image that contains a com.apple.decmpfs extended attribute whose attr_size is between 1 and 15 bytes - the undersized attribute causes the decmpfs header read to exceed the allocation. Limiting factors that reduce realistic risk: the vector is local (AV:L), so it cannot be triggered remotely; user interaction is required (the analyst must choose to process the malicious image); the product must be at or before version 4.15.0; and the impact is confined to crashing the analysis tool (availability only), with no confirmed code execution or data disclosure.

This is a medium-severity denial-of-service issue, not a high-priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8 and tells a consistent story: a local vector requiring the victim/analyst to process an attacker-supplied file, no authentication, passive user interaction, and availability-only impact (a crash) with explicitly NO confidentiality or integrity impact. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the modest technical impact. No EPSS score and no CISA KEV entry are provided, and there is no indication of active exploitation. A public PoC reference exists (a hackmd writeup) but it is not verified as working exploit code. Notably, the 'Information Disclosure' tag overstates the risk: although CWE-125 is an out-of-bounds READ, the CVSS rates VC:N - the assessed consequence is a tool crash, not memory disclosure. Real-world risk is therefore an anti-forensics / tooling-stability concern (a crafted image that crashes istat/icat mid-investigation) rather than a widely weaponizable flaw. No EPSS or KEV data is available to confirm exploitation prevalence.

An attacker crafts a malicious HFS+ disk image containing a com.apple.decmpfs extended attribute with an attr_size of 1 to 15 bytes, then causes a forensic analyst to examine it with Sleuth Kit tools such as istat or icat. When hfs_load_extended_attrs() reads the decmpfs header without validating the attribute length, it reads past the heap allocation and crashes the tool. A public PoC reference (hackmd writeup) exists but is not verified as working exploit code; the attack is local and requires the analyst to run the tool on the crafted image.