CVE-2026-120454

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...