# CVE-2026-40026: Sleuth Kit out-of-bounds read in ISO9660 SUSP parser

Source: https://junglewise.ai/threats/cve-2026-40026-sleuth-kit-out-of-bounds-read-in-iso9660-susp-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-40026 · Severity: medium · CVSS 4.4 · Published 2026-04-08

The Sleuth Kit, a widely used digital forensics library for analyzing disk images, contains a flaw in how it processes ISO9660 (CD/DVD) filesystems. An attacker can provide a specially crafted disk image that, when scanned by an investigator, causes the software to crash or potentially leak sensitive information from the system's memory. This could disrupt forensic investigations or allow an adversary to gain insight into the investigator's workstation.

Technologies: [Sleuthkit The Sleuth Kit](https://junglewise.ai/threats/technologies/the-sleuth-kit). Vendors: [Sleuthkit](https://junglewise.ai/threats/vendors/sleuthkit).

## Quick answers

**Is CVE-2026-40026 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40026 being exploited in the wild.

**How severe is CVE-2026-40026?** Medium severity, with a CVSS score of 4.4, published 8 April 2026.

**Which products and versions are affected?** Sleuth Kit The Sleuth Kit through 4.14.0.

**Is there a fix for CVE-2026-40026?** A patch was published on 2026-03-01: Fix merged into develop-4.14 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40026 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-40026?** Check whether you run Sleuthkit The Sleuth Kit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the ISO9660 filesystem parser within the `parse_susp()` function. The root cause is the improper validation of `len_id`, `len_des`, and `len_src` fields from the disk image, which are trusted during `memcpy` operations into a stack buffer without verifying they remain within the bounds of the SUSP block. Additionally, a zero-length SUSP entry can trigger an infinite parsing loop, leading to a denial of service. Exploitation requires a user to open a maliciously crafted ISO image. A fix has been committed to the project's repository (commit a95b0ac).

## Affected products

- Sleuth Kit The Sleuth Kit through 4.14.0

## Timeline

- 2026-03-01: patched: Fix merged into develop-4.14 branch
- 2026-04-08: disclosed: Initial disclosure by VulnCheck and Mobasi
- 2026-04-08: advisory: NVD publication date

## References

- [https://github.com/sleuthkit/sleuthkit/commit/a95b0ac21733b059a517aaefa667a17e1bcbdee1](https://github.com/sleuthkit/sleuthkit/commit/a95b0ac21733b059a517aaefa667a17e1bcbdee1)
- [https://github.com/sleuthkit/sleuthkit/pull/3445](https://github.com/sleuthkit/sleuthkit/pull/3445)
- [https://mobasi.ai/sentinel](https://mobasi.ai/sentinel)
- [https://www.vulncheck.com/advisories/sleuth-kit-iso9660-susp-extension-reference-out-of-bounds-read](https://www.vulncheck.com/advisories/sleuth-kit-iso9660-susp-extension-reference-out-of-bounds-read)

## Related threats

- [The Sleuth Kit NULL pointer dereference in LZVN decompression](https://junglewise.ai/threats/cve-2026-120454-the-sleuth-kit-through-4-15-0-contains-a-null-pointer)
- [Sleuth Kit out-of-bounds read in APFS keybag parser](https://junglewise.ai/threats/cve-2026-40025-sleuth-kit-out-of-bounds-read-in-apfs-keybag-parser)
- [The Sleuth Kit path traversal in tsk_recover](https://junglewise.ai/threats/cve-2026-40024-the-sleuth-kit-path-traversal-in-tsk-recover)