https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40026.htmlhttps://patchthecve.com/cve/CVE-2026-40026.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 4.4: The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsedhttps://patchthecve.com/cve/CVE-2026-40025.htmlhttps://patchthecve.com/cve/CVE-2026-40025.htmlSat, 25 Jul 2026 11:10:00 +0000MEDIUM 4.4: The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS dhttps://patchthecve.com/cve/CVE-2026-40024.htmlhttps://patchthecve.com/cve/CVE-2026-40024.htmlSat, 25 Jul 2026 11:10:00 +0000HIGH 7.1: The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can cra