Executive brief
The Sleuth Kit, a widely used digital forensics library for analyzing disk images, contains a flaw in how it processes ISO9660 (CD/DVD) filesystems. An attacker can provide a specially crafted disk image that, when scanned by an investigator, causes the software to crash or potentially leak sensitive information from the system's memory. This could disrupt forensic investigations or allow an adversary to gain insight into the investigator's workstation.
Technical details
An out-of-bounds read vulnerability exists in the ISO9660 filesystem parser within the `parse_susp()` function. The root cause is the improper validation of `len_id`, `len_des`, and `len_src` fields from the disk image, which are trusted during `memcpy` operations into a stack buffer without verifying they remain within the bounds of the SUSP block. Additionally, a zero-length SUSP entry can trigger an infinite parsing loop, leading to a denial of service. Exploitation requires a user to open a maliciously crafted ISO image. A fix has been committed to the project's repository (commit a95b0ac).
Affected products
- Sleuth Kit The Sleuth Kit through 4.14.0
Timeline
- 2026-03-01: patched: Fix merged into develop-4.14 branch
- 2026-04-08: disclosed: Initial disclosure by VulnCheck and Mobasi
- 2026-04-08: advisory: NVD publication date