Vulnerability Description
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SUSP block. An attacker can craft a malicious ISO image that causes reads past the end of the SUSP data buffer, and a zero-length SUSP entry can trigger an infinite parsing loop.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sleuthkit | The Sleuth Kit | < 4.14.0 |
Related Weaknesses (CWE)
References
- https://github.com/sleuthkit/sleuthkit/commit/a95b0ac21733b059a517aaefa667a17e1bPatch
- https://github.com/sleuthkit/sleuthkit/pull/3445Issue Tracking
- https://mobasi.ai/sentinelThird Party Advisory
- https://www.vulncheck.com/advisories/sleuth-kit-iso9660-susp-extension-referenceThird Party Advisory
FAQ
What is CVE-2026-40026?
CVE-2026-40026 is a vulnerability with a CVSS score of 4.4 (MEDIUM). The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk ima...
How severe is CVE-2026-40026?
CVE-2026-40026 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-40026?
Check the references section above for vendor advisories and patch information. Affected products include: Sleuthkit The Sleuth Kit.