Vulnerability-Lookup

CERTFR-2026-AVI-0428

Vulnerability from certfr_avis - Published: 2026-04-13 - Updated: 2026-04-13

De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	azl3 openssl 3.3.5-4 versions antérieures à 3.3.5-5
Microsoft	N/A	azl3 sudo 1.9.17-1 versions antérieures à 1.9.17-2
Microsoft	N/A	azl3 openssh 9.8p1-5 versions antérieures à 9.8p1-6
Microsoft	N/A	azl3 vim 9.2.0240-1 versions antérieures à 9.2.0323-1
Microsoft	N/A	azl3 sleuthkit 4.12.1-1 versions antérieures à 4.12.1-2

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft CVE-2026-40024	2026-04-10	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-40025	2026-04-10	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-40026	2026-04-10	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-35386	2026-04-04	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-35388	2026-04-04	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-39881	2026-04-10	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-31790	2026-04-09	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-35535	2026-04-05	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-28388	2026-04-09	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-28390	2026-04-11	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-31789	2026-04-09	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-35385	2026-04-04	vendor-advisory
Bulletin de sécurité Microsoft CVE-2026-28389	2026-04-11	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "azl3 openssl 3.3.5-4 versions ant\u00e9rieures \u00e0 3.3.5-5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 sudo 1.9.17-1 versions ant\u00e9rieures \u00e0 1.9.17-2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 openssh 9.8p1-5 versions ant\u00e9rieures \u00e0 9.8p1-6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 vim 9.2.0240-1 versions ant\u00e9rieures \u00e0 9.2.0323-1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 sleuthkit 4.12.1-1 versions ant\u00e9rieures \u00e0 4.12.1-2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-40024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40024"
    },
    {
      "name": "CVE-2026-35388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35388"
    },
    {
      "name": "CVE-2026-35386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35386"
    },
    {
      "name": "CVE-2026-40026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40026"
    },
    {
      "name": "CVE-2026-39881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39881"
    },
    {
      "name": "CVE-2026-28389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28389"
    },
    {
      "name": "CVE-2026-35535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35535"
    },
    {
      "name": "CVE-2026-28388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28388"
    },
    {
      "name": "CVE-2026-35385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
    },
    {
      "name": "CVE-2026-28390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
    },
    {
      "name": "CVE-2026-40025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40025"
    },
    {
      "name": "CVE-2026-31789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31789"
    },
    {
      "name": "CVE-2026-31790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
    }
  ],
  "initial_release_date": "2026-04-13T00:00:00",
  "last_revision_date": "2026-04-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0428",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": "2026-04-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40024",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40024"
    },
    {
      "published_at": "2026-04-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40025",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40025"
    },
    {
      "published_at": "2026-04-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40026",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40026"
    },
    {
      "published_at": "2026-04-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-35386",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35386"
    },
    {
      "published_at": "2026-04-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-35388",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35388"
    },
    {
      "published_at": "2026-04-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-39881",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-39881"
    },
    {
      "published_at": "2026-04-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31790",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31790"
    },
    {
      "published_at": "2026-04-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-35535",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35535"
    },
    {
      "published_at": "2026-04-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-28388",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28388"
    },
    {
      "published_at": "2026-04-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-28390",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28390"
    },
    {
      "published_at": "2026-04-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31789",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31789"
    },
    {
      "published_at": "2026-04-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-35385",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35385"
    },
    {
      "published_at": "2026-04-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-28389",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28389"
    }
  ]
}

CVE-2026-40024 (GCVE-0-2026-40024)

Vulnerability from cvelistv5 – Published: 2026-04-08 21:35 – Updated: 2026-04-09 18:13 X_Open Source

Title

Sleuth Kit tsk_recover Path Traversal

Summary

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck

References

3 references

URL	Tags
https://github.com/sleuthkit/sleuthkit/commit/a3f…	patch
https://mobasi.ai/sentinel	vendor-advisory
https://www.vulncheck.com/advisories/sleuth-kit-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sleuthkit	sleuthkit	Affected: 0 , ≤ 4.14.0 (custom) Unaffected: a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b (git)

Date Public

2026-02-28 00:00

Credits

Mobasi Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T18:12:19.473427Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T18:13:37.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "sleuthkit",
          "vendor": "sleuthkit",
          "versions": [
            {
              "lessThanOrEqual": "4.14.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mobasi Security Team"
        }
      ],
      "datePublic": "2026-02-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T21:35:20.662Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b"
        },
        {
          "name": "Mobasi Sentinel Vulnerability Index",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mobasi.ai/sentinel"
        },
        {
          "name": "VulnCheck Advisory: Sleuth Kit tsk_recover Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Sleuth Kit tsk_recover Path Traversal",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-40024",
    "datePublished": "2026-04-08T21:35:20.662Z",
    "dateReserved": "2026-04-08T13:35:50.657Z",
    "dateUpdated": "2026-04-09T18:13:37.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40025 (GCVE-0-2026-40025)

Vulnerability from cvelistv5 – Published: 2026-04-08 21:35 – Updated: 2026-06-23 16:16 X_Open Source

Title

Sleuth Kit APFS Keybag Parser Out-of-Bounds Read

Summary

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck

References

4 references

URL	Tags
https://github.com/sleuthkit/sleuthkit/pull/3444	issue-tracking
https://github.com/sleuthkit/sleuthkit/commit/8b9…	patch
https://mobasi.ai/sentinel	vendor-advisory
https://www.vulncheck.com/advisories/sleuth-kit-a…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sleuthkit	sleuthkit	Affected: 0 , ≤ 4.14.0 (custom) Unaffected: 8b9c9e7d493bd68624f3b1a3963edd45c3ff7611 (git)

Date Public

2026-03-01 00:00

Credits

Mobasi Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40025",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T15:03:14.878617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T16:16:39.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "sleuthkit",
          "vendor": "sleuthkit",
          "versions": [
            {
              "lessThanOrEqual": "4.14.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "8b9c9e7d493bd68624f3b1a3963edd45c3ff7611",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mobasi Security Team"
        }
      ],
      "datePublic": "2026-03-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that parses APFS volumes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:16:26.744Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/pull/3444"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/commit/8b9c9e7d493bd68624f3b1a3963edd45c3ff7611"
        },
        {
          "name": "Mobasi Sentinel Vulnerability Index",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mobasi.ai/sentinel"
        },
        {
          "name": "VulnCheck Advisory: Sleuth Kit APFS Keybag Parser Out-of-Bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sleuth-kit-apfs-keybag-parser-out-of-bounds-read"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Sleuth Kit APFS Keybag Parser Out-of-Bounds Read",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-40025",
    "datePublished": "2026-04-08T21:35:21.537Z",
    "dateReserved": "2026-04-08T13:36:42.932Z",
    "dateUpdated": "2026-06-23T16:16:26.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40026 (GCVE-0-2026-40026)

Vulnerability from cvelistv5 – Published: 2026-04-08 21:35 – Updated: 2026-06-23 16:16 X_Open Source

Title

Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read

Summary

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SUSP block. An attacker can craft a malicious ISO image that causes reads past the end of the SUSP data buffer, and a zero-length SUSP entry can trigger an infinite parsing loop.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck

References

4 references

URL	Tags
https://github.com/sleuthkit/sleuthkit/pull/3445	issue-tracking
https://github.com/sleuthkit/sleuthkit/commit/a95…	patch
https://mobasi.ai/sentinel	vendor-advisory
https://www.vulncheck.com/advisories/sleuth-kit-i…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sleuthkit	sleuthkit	Affected: 0 , ≤ 4.14.0 (custom) Unaffected: a95b0ac21733b059a517aaefa667a17e1bcbdee1 (git)

Date Public

2026-03-01 00:00

Credits

Mobasi Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T19:38:20.459891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T19:39:36.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "sleuthkit",
          "vendor": "sleuthkit",
          "versions": [
            {
              "lessThanOrEqual": "4.14.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "a95b0ac21733b059a517aaefa667a17e1bcbdee1",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mobasi Security Team"
        }
      ],
      "datePublic": "2026-03-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SUSP block. An attacker can craft a malicious ISO image that causes reads past the end of the SUSP data buffer, and a zero-length SUSP entry can trigger an infinite parsing loop."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:16:27.431Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/pull/3445"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sleuthkit/sleuthkit/commit/a95b0ac21733b059a517aaefa667a17e1bcbdee1"
        },
        {
          "name": "Mobasi Sentinel Vulnerability Index",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mobasi.ai/sentinel"
        },
        {
          "name": "VulnCheck Advisory: Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sleuth-kit-iso9660-susp-extension-reference-out-of-bounds-read"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-40026",
    "datePublished": "2026-04-08T21:35:22.278Z",
    "dateReserved": "2026-04-08T13:36:44.872Z",
    "dateUpdated": "2026-06-23T16:16:27.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0428

Solutions

CVE-2026-40024 (GCVE-0-2026-40024)

CVE-2026-40025 (GCVE-0-2026-40025)

CVE-2026-40026 (GCVE-0-2026-40026)

Tags

Sightings

Nomenclature