scalpel

As of 6/27/2013 Scalpel has been released under the Apache 2.0 License and the source is available at The Sleuth Kit github repository. It is not being actively maintained. The Autopsy team started to do work on it to integrate tightly into via Java/JNI bindings, but ran into several memory leaks...

libewf

libewf is a library to access the Expert Witness Compression Format EWF. Project information: Status: experimental Licence: LGPL-3.0-or-later Read or write supported EWF formats: SMART .s01 EWF-S01 EnCase .E01 EWF-E01 .Ex01 EWF2-Ex01 Not supported: .Ex01 EWF2-Ex01 bzip2 compression work in progre...

CVE-2026-120453

A flaw was found in The Sleuth Kit. When processing extended attributes on an HFS+ filesystem image, the application reads compression headers without properly validating the attribute length. An attacker could provide a specially crafted disk image to trigger an out-of-bounds memory read, causin...

CVE-2026-120453

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120454

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

CVE-2026-120453

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120454 The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

CVE-2026-120454

The Sleuth Kit through version 4.15.0 contains a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. An attacker can cause a denial of service (DoS) by providing a crafted HFS+ image with a very large uncompressed_size in an LZVN inline com.apple.decmpfs attribu...

EUVD-2026-115214

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

CVE-2026-120454 The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

CVE-2026-120453 The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120453

The Sleuth Kit through version 4.15.0 is vulnerable to a heap out-of-bounds read in the hfs_load_extended_attrs() function located in tsk/fs/hfs.c. The flaw occurs because the application fails to validate the attribute length when reading the decmpfs header . An attacker can exploit this by prov...

CVE-2026-120453 The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

EUVD-2026-115213

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120453 The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120453: The Sleuth Kit: The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in…

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120454: The Sleuth Kit: The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that…

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

PT-2026-135469

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs load extended attrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr size of 1 to 15 to read past the...

PT-2026-135470

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs decompress lzvn attr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed size in an LZVN inline com.apple.decmpfs attribute so allocation fails a...

sleuthkit

The Sleuth Kit INTRODUZIONE The Sleuth Kit è un toolkit forense open source per l'analisi di file system e dischi Microsoft e UNIX. The Sleuth Kit consente agli investigatori di identificare e recuperare prove da immagini acquisite durante la risposta a incidenti o da sistemi live. The Sleuth Kit...