VulnSea

The Sleuth Kit has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 4.4 (medium).

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
0% vs 1% corpus
Median CVSS
4.4
Publish → KEV
—
Last 90 days
2 prev 0

Weakness classes

Products

  • The Sleuth Kit 2
Follow The Sleuth Kit:RSS feedSave a search →Embed badge ↗
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

The Sleuth Kit vulnerabilities

CVEs affecting The Sleuth Kit, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-120453Low· 3.3PoC
6d ago

The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a…

▾ TwilightThe Sleuth Kit · The Sleuth KitEPSS 0.23%via CVEORG
CVE-2026-120454Medium· 5.5PoC
6d ago

The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an…

▾ TwilightThe Sleuth Kit · The Sleuth KitEPSS 0.12%via CVEORG
The Sleuth Kit vulnerabilities (CVEs) · VulnSea