Is CVE-2026-120454 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120454 being exploited in the wild.

How severe is CVE-2026-120454?

Medium severity, with a CVSS score of 5.5, published 2 November 2026.

Which products and versions are affected?

Sleuthkit The Sleuth Kit through 4.15.0.

How is CVE-2026-120454 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-120454?

Check whether you run Sleuthkit The Sleuth Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120454: The Sleuth Kit NULL pointer dereference in LZVN decompression

CVE-2026-120454 · Severity: medium · CVSS 5.5 · Published 2026-11-02

The Sleuth Kit is a digital forensics tool used to analyze file systems and recover data from disk images. A flaw in its HFS+ compression handling allows an attacker to crash the tool by supplying a maliciously crafted disk image, causing denial of service during forensic investigations. The vulnerability occurs when the tool processes specially crafted compression metadata that triggers a memory allocation failure.

Technologies: Sleuthkit The Sleuth Kit. Vendors: Sleuthkit.

Quick answers

Is CVE-2026-120454 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120454 being exploited in the wild.
How severe is CVE-2026-120454?: Medium severity, with a CVSS score of 5.5, published 2 November 2026.
Which products and versions are affected?: Sleuthkit The Sleuth Kit through 4.15.0.
Is there a fix for CVE-2026-120454?: No fixed version is recorded yet. Avoid processing untrusted HFS+ disk images with The Sleuth Kit until a patched version is available; if forensic analysis of such images is necessary, run the tool in an isolated environment to contain potential crashes. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120454 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-120454?: Check whether you run Sleuthkit The Sleuth Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Avoid processing untrusted HFS+ disk images with The Sleuth Kit until a patched version is available; if forensic analysis of such images is necessary, run the tool in an isolated environment to contain potential crashes.

Technical details

The vulnerability is a NULL pointer dereference (CWE-476) combined with an uncontrolled allocation size (CWE-789) in the decmpfs_decompress_lzvn_attr() function. When processing an HFS+ file with a com.apple.decmpfs attribute of type LZVN compression (type 7), if the uncompressed_size field is set to an extremely large value (e.g., 0x7fffffffffffffff), the allocation fails and returns NULL; the code then passes this NULL pointer directly to lzvn_decode_buffer() without checking, causing a crash. The attack requires only a crafted HFS+ image; no authentication or user interaction is needed beyond opening the image.

Affected products

Sleuthkit The Sleuth Kit through 4.15.0

Timeline

2026-11-02: disclosed
2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.