CVE-2026-40025

Katalog CVE

CVSS 6.1 · Medium EPSS 0,18%

Kerentanan Out-of-bounds Read pada sleuthkit the sleuth kit. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sleuthkit/sleuthkit/commit/8b9c9e7d493bd68624f3b1a3963edd45c3ff7611 patch
• https://mobasi.ai/sentinel advisory pihak ketiga
• https://www.vulncheck.com/advisories/sleuth-kit-apfs-keybag-parser-out-of-bounds-read advisory pihak ketiga
• https://github.com/sleuthkit/sleuthkit/pull/3444 issue tracking