CVE-2026-120453

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

EUVD-2026-115213

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120453

The Sleuth Kit through version 4.15.0 is vulnerable to a heap out-of-bounds read in the hfs_load_extended_attrs() function located in tsk/fs/hfs.c. The flaw occurs because the application fails to validate the attribute length when reading the decmpfs header . An attacker can exploit this by prov...

CVE-2026-120453 The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120453 The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

CVE-2026-120453: The Sleuth Kit: The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in…

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfsloadextendedattrs in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attrsize of 1 to 15 to read past the allocatio...

sleuthkit:sleuthkit_fls_hfs_fuzzer: Crash in hfs_load_extended_attrs

Detailed Report: https://oss-fuzz.com/testcase?key=5807962357825536 Project: sleuthkit Fuzzing Engine: libFuzzer Fuzz Target: sleuthkitflshfsfuzzer Job Type: libfuzzerubsansleuthkit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x55feffeb0781 Crash State: hfsloadextendedattrs...

sleuthkit:sleuthkit_fls_hfs_fuzzer: Crash in hfs_load_extended_attrs

Detailed Report: https://oss-fuzz.com/testcase?key=5442328178524160 Project: sleuthkit Fuzzing Engine: libFuzzer Fuzz Target: sleuthkitflshfsfuzzer Job Type: libfuzzerubsansleuthkit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x555f8ef2f4d3 Crash State: hfsloadextendedattrs...

sleuthkit:sleuthkit_fls_hfs_fuzzer: Heap-buffer-overflow in hfs_load_extended_attrs

Project: https://github.com/sleuthkit/sleuthkit.git Detailed Report: https://oss-fuzz.com/testcase?key=5072584086978560 Project: sleuthkit Fuzzing Engine: libFuzzer Fuzz Target: sleuthkitflshfsfuzzer Job Type: libfuzzerasansleuthkit Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...