Description
libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libyal libewf
Default version status: unaffected
0 to ≤ 20260924affected
References
- https://hackmd.io/@haind-pwn/libewf-lef-extended-attribute-utf16-size-oob-read ↗
- https://github.com/libyal/libewf/blob/d76fd0bb21601e2969bc88ffdaeb861023f6a5b2/libewf/libewf_lef_extended_attribute.c#L362-L408 ↗
- https://github.com/libyal/libewf/blob/d76fd0bb21601e2969bc88ffdaeb861023f6a5b2/libewf/libewf_lef_extended_attribute.c#L456-L560 ↗
- https://github.com/libyal/libewf ↗
- https://www.vulncheck.com/advisories/libewf-through-20260924-heap-out-of-bounds-read-via-l01-extended-attribute-parsing ↗