CVE-2026-40026: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-40026 is an out-of-bounds read vulnerability in The Sleuth Kit's ISO9660 filesystem parser, affecting versions through 4.14.0. The parse_susp() function in tsk/fs/iso9660.c blindly trusts attacker-controlled len_id, len_des, and len_src fields from a disk image when performing memcpy operations into a fixed-size stack buffer, without verifying that the source data falls within the parsed SUSP block. Additionally, a zero-length SUSP entry can trigger an infinite parsing loop. The vulnerability was reported by Mobasi, disclosed on April 8, 2026, and patched via a commit merged on March 1, 2026. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-130 (Improper Handling of Length Parameter Inconsistency). In parse_susp(), the iso9660_susp_er structure's len_id, len_des, and len_src fields are read directly from the disk image and used as arguments to memcpy into a 258-byte stack buffer (buf[258]) without bounds validation against the end of the SUSP data block. A crafted ISO image can supply oversized length values causing reads past the buffer boundary, potentially exposing stack memory. Separately, a SUSP entry with head->len == 0 causes the parser to never advance its position pointer, resulting in an infinite loop. The fix (commit a95b0ac) adds explicit bounds checks — verifying each length field is less than 256 and that the source pointer plus length does not exceed the end pointer — and adds a head->len == 0 guard to break the loop (GitHub Commit, GitHub PR).

Successful exploitation can result in information disclosure by reading stack memory contents beyond the intended SUSP buffer, potentially exposing sensitive data from the process's memory space. A zero-length SUSP entry can cause the parser to enter an infinite loop, leading to denial of service (application hang or resource exhaustion). Exploitation requires user interaction — a victim must open or process a malicious ISO image using an affected version of The Sleuth Kit — limiting the attack surface primarily to forensic analysts, automated disk image processing pipelines, and systems that parse untrusted ISO files (Github Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access and user interaction (passive), as the victim must process a crafted ISO image, further reducing practical exploitability (Github Advisory).

1. Craft a malicious ISO image: Create an ISO9660 image with a crafted SUSP (System Use Sharing Protocol) block containing an ER (Extension Reference) entry where len_id, len_des, or len_src fields are set to values larger than the actual data present in the SUSP block, causing the calculated source pointer to exceed the block boundary.
2. Alternatively, trigger DoS: Set the head->len field of a SUSP entry to zero, which causes the parse_susp() loop to never advance, resulting in an infinite loop.
3. Deliver the ISO to the target: Distribute the malicious ISO image to a forensic analyst or system that uses The Sleuth Kit (version ≤ 4.14.0) to process disk images — for example, via email, file share, or as part of a case submission.
4. Trigger parsing: The victim opens or processes the ISO image using a TSK tool (e.g., icat, fls, fsstat) or an application built on The Sleuth Kit's library, causing parse_susp() to be invoked.
5. Achieve objective: The out-of-bounds read exposes stack memory contents (information disclosure), or the infinite loop causes the TSK process to hang indefinitely (denial of service) (GitHub Commit, Github Advisory).

• File System: Presence of an ISO image with anomalous SUSP/Rock Ridge extension data — specifically ER entries where len_id + len_des + len_src exceeds the declared SUSP block length, or entries with a zero-length head->len field.
• Process Behavior: TSK tools (e.g., icat, fls, fsstat, mmls) or applications using libtsk hanging indefinitely or consuming 100% CPU while processing an ISO image, indicative of the infinite loop condition.
• Logs: Application crash logs or core dumps from TSK processes with stack traces referencing parse_susp() in tsk/fs/iso9660.c; memory sanitizer (ASan/Valgrind) reports of out-of-bounds reads in the same function.
• Network: Unexpected delivery of ISO files from untrusted external sources to systems running forensic analysis pipelines.

Update The Sleuth Kit to a version newer than 4.14.0 that includes the fix from commit a95b0ac (merged March 1, 2026 into the develop-4.14 branch via PR #3445). As a workaround, restrict ISO image processing to trusted, verified sources and avoid processing untrusted disk images with affected versions. Consider running TSK tools in sandboxed or resource-limited environments (e.g., with CPU time limits via ulimit) to mitigate the denial-of-service impact of the infinite loop condition. Monitor for unexpected hangs or crashes during ISO parsing as potential signs of exploitation (GitHub PR, Github Advisory).

The vulnerability was reported to The Sleuth Kit maintainers by Mobasi (via their Sentinel platform), and the fix was promptly merged by project maintainer bcarrier on March 1, 2026. Red Hat tracked the issue via Bugzilla (Bug 2456789) and classified it as medium severity. Microsoft also referenced the CVE in their Security Response Center update guide. No significant broader community discussion or media coverage has been identified beyond standard vulnerability database entries (GitHub PR, Red Hat Bugzilla).