Executive brief
The Sleuth Kit, a widely used digital forensics library for analyzing disk images, contains a flaw in how it processes Apple File System (APFS) volumes. An attacker can create a specially crafted disk image that, when opened by a forensic investigator using Sleuth Kit tools, causes the software to crash or potentially leak sensitive information from the investigator's computer memory. This could be used to hinder forensic investigations or compromise the integrity of the analysis environment.
Technical details
An out-of-bounds read vulnerability exists in The Sleuth Kit through version 4.14.0 within the APFS filesystem keybag parser. The 'wrapped_key_parser' class fails to perform adequate bounds checking when following length fields provided within the filesystem structures, allowing for heap-based reads beyond the allocated buffer. An attacker can exploit this by providing a malicious APFS disk image to any Sleuth Kit tool (or application utilizing the library) that parses APFS volumes. This can result in a denial-of-service (crash) or the disclosure of sensitive information from the heap. The issue has been addressed in the project's development branch via commit 8b9c9e7.
Affected products
- Sleuth Kit The Sleuth Kit through 4.14.0
Timeline
- 2026-02-28: patched: Fix committed to repository
- 2026-03-05: disclosed: Initial disclosure by Mobasi Sentinel program
- 2026-04-08: advisory: NVD publication date