The Sleuth Kit CVE-2026-120454

Exploitation requires an attacker to supply a crafted HFS+ image containing an LZVN inline com.apple.decmpfs attribute whose uncompressed_size field is set to a huge value, causing the memory allocation in decmpfs_decompress_lzvn_attr() to fail so the decoder writes through a NULL pointer. The crafted image must actually be parsed by The Sleuth Kit (version 4.15.0 or earlier), so exploitation is gated on a victim analyst or automated forensic pipeline loading the untrusted image - this is the passive user interaction (UI:P) and local vector (AV:L) in the CVSS. Limiting factors: it is not remotely triggerable without image ingestion, no authentication bypass or code execution results, and the sole impact is a crash (denial of service); it affects The Sleuth Kit through 4.15.0 and no fixed version is identified in the available sources.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, score 6.8) shows a local attack vector requiring passive user interaction, with impact limited to availability (VA:H) and no confidentiality or integrity impact - consistent with a crash-only NULL pointer dereference. The flaw is not in CISA KEV (no confirmed active exploitation), and no EPSS exploitation-probability score was supplied, so widespread-exploitation likelihood cannot be quantified from the input. A public PoC reference (a hackmd write-up) is linked but is not verified as working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), which matches the picture of a bounded, non-remote DoS. Real-world risk is concentrated in a specific scenario: DFIR analysts or automated malware/forensic pipelines that ingest untrusted disk images, where a crafted image can abort processing (an anti-forensics / availability concern). There is no network vector and no path to code execution in the supplied data. One discrepancy to verify: the linked hackmd write-up is titled as an out-of-bounds read, whereas the CVE description specifies a NULL pointer dereference (write through NULL) - the two sources describe different bug mechanics and should be reconciled with the vendor/VulnCheck advisory.

An attacker crafts a malicious HFS+ disk image containing an LZVN inline com.apple.decmpfs attribute with an enormous uncompressed_size, then gets it ingested by a forensic analyst or an automated DFIR/malware-triage pipeline running The Sleuth Kit (or Autopsy, which embeds it). When the decmpfs LZVN decompressor processes the image, the oversized allocation fails and the decoder writes through a NULL pointer, crashing the tool and halting analysis. A public PoC reference exists (hackmd write-up) but is not verified as working exploit code; the local vector and required user interaction mean the victim must actively process the attacker-supplied image.