The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SUSP block. An attacker can craft a malicious ISO image that causes reads past the end of the SUSP data buffer, and a zero-length SUSP entry can trigger an infinite parsing loop.
References
| Link | Resource |
|---|---|
| https://github.com/sleuthkit/sleuthkit/commit/a95b0ac21733b059a517aaefa667a17e1bcbdee1 | Patch |
| https://github.com/sleuthkit/sleuthkit/pull/3445 | Issue Tracking |
| https://mobasi.ai/sentinel | Third Party Advisory |
| https://www.vulncheck.com/advisories/sleuth-kit-iso9660-susp-extension-reference-out-of-bounds-read | Third Party Advisory |
Configurations
History
17 Apr 2026, 17:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/sleuthkit/sleuthkit/commit/a95b0ac21733b059a517aaefa667a17e1bcbdee1 - Patch | |
| References | () https://github.com/sleuthkit/sleuthkit/pull/3445 - Issue Tracking | |
| References | () https://mobasi.ai/sentinel - Third Party Advisory | |
| References | () https://www.vulncheck.com/advisories/sleuth-kit-iso9660-susp-extension-reference-out-of-bounds-read - Third Party Advisory | |
| First Time |
Sleuthkit
Sleuthkit the Sleuth Kit |
|
| CPE | cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:* |
08 Apr 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-08 22:16
Updated : 2026-04-17 17:14
NVD link : CVE-2026-40026
Mitre link : CVE-2026-40026
CVE.ORG link : CVE-2026-40026
JSON object : View
Products Affected
sleuthkit
- the_sleuth_kit
CWE
CWE-125
Out-of-bounds Read