Home

Description

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SUSP block. An attacker can craft a malicious ISO image that causes reads past the end of the SUSP data buffer, and a zero-length SUSP entry can trigger an infinite parsing loop.

PUBLISHED Reserved 2026-04-08 | Published 2026-04-08 | Updated 2026-04-09 | Assigner VulnCheck




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

MEDIUM: 4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Problem types

CWE-125: Out-of-bounds Read

Product status

Default status
unaffected

Any version
affected

a95b0ac21733b059a517aaefa667a17e1bcbdee1 (git)
unaffected

Credits

Mobasi Security Team finder

References

github.com/sleuthkit/sleuthkit/pull/3445 (Pull Request) product

github.com/...ommit/a95b0ac21733b059a517aaefa667a17e1bcbdee1 (Patch Commit) patch

mobasi.ai/sentinel (Mobasi Sentinel Vulnerability Index) vendor-advisory

www.vulncheck.com/...-extension-reference-out-of-bounds-read (VulnCheck Advisory: Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read) third-party-advisory

cve.org (CVE-2026-40026)

nvd.nist.gov (CVE-2026-40026)

Download JSON