PT-2026-31463
CVE-2026-40026
·
Published
2026-04-08
·
Updated
2026-04-17
Description by
CVSS 4.0
8.4
HighMetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
The Sleuth Kit versions through 4.14.0
Description
The Sleuth Kit contains an out-of-bounds read issue in the ISO9660 filesystem parser. The
parse susp() function does not properly validate the len id, len des, and len src fields from the disk image before copying data into a stack buffer. This can lead to reads beyond the allocated memory, and a zero-length SUSP entry can cause an infinite loop.Recommendations
Update to a version newer than 4.14.0.
Found an issue in the description? Have something to add? Feel free to write us 👾