Executive brief
A vulnerability in the lwext4 library, which provides ext4 filesystem support for embedded systems, could allow an attacker to crash applications using the library. By providing a specially crafted or corrupted filesystem image, an attacker can trigger a memory error that leads to a denial of service. This could impact the availability of devices or software that automatically mount or read external storage media.
Technical details
An out-of-bounds read exists in the ext4_ext_binsearch_idx function within src/ext4_extent.c of lwext4 1.0.0. The vulnerability is caused by insufficient validation of the extent header fields (specifically eh_entries and eh_depth) before performing a binary search over extent index entries. If a crafted filesystem image contains an internal node where eh_depth is greater than zero but eh_entries is zero, the EXT_FIRST_INDEX and EXT_LAST_INDEX macros return invalid pointers. This leads to invalid pointer calculations and a subsequent out-of-bounds memory read (segmentation fault) during extent tree traversal. Attackers can exploit this by providing a malicious filesystem image to be processed by the library.
Affected products
- gkostka lwext4 1.0.0
Timeline
- 2025-12-09: disclosed: Issue reported on GitHub
- 2026-06-03: advisory: NVD published CVE-2025-70101