CVE-2019-14532
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an...
CVE-2019-14532 is a critical vulnerability (CVSS 9.8) in Sleuthkit The Sleuth Kit, published August 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in sleuthkit 4.9.0-1.mga7.
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
CVE-2019-14532- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-193
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
CVE-2019-14532- Updated
- 2026-11-02
EUVDEUVD-2019-5702 No score
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
EUVD-2019-5702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mx7-79gg-f646
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an...
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
GHSA-6mx7-79gg-f646- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-191, CWE-193
- Updated
- 2026-11-02
OSV
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
CVE-2019-14532- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14532
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
DEBIAN-CVE-2019-14532- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14532
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
- Record
UBUNTU-CVE-2019-14532- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0234 No score
Updated sleuthkit packages fix security vulnerability
Updated sleuthkit packages fix security vulnerabilities:
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table (CVE-2019-14532).
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c (CVE-2020-10233).
- Record
MGASA-2020-0234- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sleuthkitDebian:12 |
All versions, plus listed versions 4.11.1+dfsg-14.12.0+dfsg-14.12.1+dfsg-14.12.1+dfsg-1.14.12.1+dfsg-1.1~exp14.12.1+dfsg-24.12.1+dfsg-34.14.0+dfsg-1 |
None known |
sleuthkitDebian:13 |
All versions, plus listed versions 4.12.1+dfsg-34.14.0+dfsg-1 |
None known |
sleuthkitDebian:14 |
All versions, plus listed versions 4.12.1+dfsg-34.14.0+dfsg-1 |
None known |
sleuthkitMageia:7 |
before 4.9.0-1.mga7 | 4.9.0-1.mga7 |
sleuthkitUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.2.3-2ubuntu13.2.3-2ubuntu23.2.3-2.13.2.3-2.23.2.3-2.2ubuntu0.1~esm1 |
None known |
sleuthkitUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.1.3-11ubuntu24.1.3-12ubuntu14.2.0-34.2.0-3ubuntu0.1~esm1 |
None known |
sleuthkitUbuntu:18.04:LTS |
All versions, plus listed versions 4.4.2-14.4.2-3 |
None known |
sleuthkitUbuntu:20.04:LTS |
All versions, plus listed versions 4.6.5-14.6.7-14.6.7-1build1 |
None known |
sleuthkitUbuntu:22.04:LTS |
All versions, plus listed versions 4.10.1+dfsg-14.11.0+dfsg-14.11.1+dfsg-1 |
None known |
sleuthkitUbuntu:24.04:LTS |
All versions, plus listed versions 4.12.0+dfsg-14.12.1+dfsg-14.12.1+dfsg-1.1ubuntu14.12.1+dfsg-1.1ubuntu2 |
None known |
sleuthkitUbuntu:25.10 |
All versions, plus listed versions 4.12.1+dfsg-1.1ubuntu24.12.1+dfsg-3 |
None known |
sleuthkitUbuntu:26.10 |
All versions, plus listed versions 4.12.1+dfsg-3build14.14.0+dfsg-1 |
None known |
sleuthkitUbuntu:26.04:LTS |
All versions, plus listed versions 4.12.1+dfsg-34.12.1+dfsg-3build1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/sleuthkit/sleuthkit/issues/1575
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EY53OYU7UZLAJWNIVVNR3EX2RNCCFTB
nvd.nist.gov/vuln/detail/CVE-2019-14532
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2019-14532
advisories.mageia.org/MGASA-2020-0234.html
bugs.mageia.org/show_bug.cgi?id=26654
ubuntu.com/security/CVE-2019-14532
cve.org/CVERecord?id=CVE-2019-14532