CVE-2026-120454

The Sleuth Kit through version 4.15.0 contains a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. An attacker can cause a denial of service (DoS) by providing a crafted HFS+ image with a very large uncompressed_size in an LZVN inline com.apple.decmpfs attribu...