PT-2026-31463 · Unknown · The Sleuth Kit
CVE-2026-40026
·
Published
2026-04-08
·
Updated
2026-04-17
CVSS v4.0
8.4
High
| Vector | AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
The Sleuth Kit versions through 4.14.0
Description
The Sleuth Kit contains an out-of-bounds read issue in the ISO9660 filesystem parser. The
parse susp() function does not properly validate the len id, len des, and len src fields from the disk image before copying data into a stack buffer. This can lead to reads beyond the allocated memory, and a zero-length SUSP entry can cause an infinite loop.Recommendations
Update to a version newer than 4.14.0.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Sleuth Kit