Out-of-Bounds Read Vulnerability in Sleuth Kit by The Sleuth Kit Team

CVE-2026-40026

What is CVE-2026-40026?

The Sleuth Kit up to version 4.14.0 contains a vulnerability within the ISO9660 filesystem parser, specifically in the parse_susp() function. The vulnerability arises from the function’s reliance on the len_id, len_des, and len_src fields from a disk image, which it uses to memcpy data into a stack buffer without proper validation. This mismanagement permits an attacker to create a malicious ISO image that can lead to unauthorized memory access, enabling reads past the boundary of the SUSP data buffer. Additionally, a zero-length SUSP entry could instigate an infinite parsing loop, which poses further security risks.

References