cve 2026-40024

CVE-2026-40024 is a path traversal vulnerability in The Sleuth Kit's tsk_recover tool, affecting versions through 4.14.0. The flaw allows an attacker to write files outside the intended recovery directory by abusing crafted filenames or directory paths inside a filesystem image. This is particularly concerning because tsk_recover is used in forensic recovery, where analysts expect hostile filenames and damaged metadata to be handled safely. The core risk is arbitrary file placement rather than memory corruption. Discussions on WindowsForum cover mitigation strategies and the impact of this vulnerability on forensic workflows.