CVE-2025-70101

An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by supplying a specially crafted ext4 filesystem image. The vulnerability occurs due to insufficient validation of extent header fields before performing a binary search over extent index entries, which can result in invalid pointer calculations and an out-of-bounds memory read during extent tree traversal.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gkostka/lwext4/issues/91	Exploit Issue Tracking Patch
https://github.com/sigdevel/pocs/blob/main/res/lwext4/3/sig11_lwext4_ext4_extent_815	Exploit
https://infosec.exchange/@sigdevel/116668958927817708	Exploit Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/29/6
https://github.com/gkostka/lwext4/issues/91	Exploit Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:gkostka:lwext4:1.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-03 14:16

Updated : 2026-07-22 19:10

NVD link : CVE-2025-70101

Mitre link : CVE-2025-70101

CVE.ORG link : CVE-2025-70101

JSON object : View

Products Affected

gkostka

lwext4

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2025-70101", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70101", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T17:35:26.349072Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-03T14:16:31.340", "references": [{"url": "https://github.com/gkostka/lwext4/issues/91", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/sigdevel/pocs/blob/main/res/lwext4/3/sig11_lwext4_ext4_extent_815", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://infosec.exchange/@sigdevel/116668958927817708", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/29/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/gkostka/lwext4/issues/91", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by supplying a specially crafted ext4 filesystem image. The vulnerability occurs due to insufficient validation of extent header fields before performing a binary search over extent index entries, which can result in invalid pointer calculations and an out-of-bounds memory read during extent tree traversal."}, {"lang": "es", "value": "Una lectura fuera de l\u00edmites en la funci\u00f3n ext4_ext_binsearch_idx en src/ext4_extent.c de la biblioteca lwext4 1.0.0 permite a los atacantes causar una denegaci\u00f3n de servicio al proporcionar una imagen de sistema de archivos ext4 especialmente dise\u00f1ada. La vulnerabilidad ocurre debido a una validaci\u00f3n insuficiente de los campos de encabezado de extensi\u00f3n antes de realizar una b\u00fasqueda binaria sobre las entradas del \u00edndice de extensi\u00f3n, lo que puede resultar en c\u00e1lculos de puntero inv\u00e1lidos y una lectura de memoria fuera de l\u00edmites durante el recorrido del \u00e1rbol de extensiones."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gkostka:lwext4:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70BC7F76-4450-4CC3-8C76-64CBB6EC4740"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}