libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing

Advisories

libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing

Severity: medium
Date: 10/15/2026
Affecting: libewf <= 20260924
CVE: CVE-2026-111159
CWE: CWE-125 Out-of-bounds Read
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind-pwn/libewf-lef-extended-attribute-utf16-size-oob-read
https://github.com/libyal/libewf/blob/d76fd0bb21601e2969bc88ffdaeb861023f6a5b2/libewf/libewf_lef_extended_attribute.c#L362-L408
https://github.com/libyal/libewf/blob/d76fd0bb21601e2969bc88ffdaeb861023f6a5b2/libewf/libewf_lef_extended_attribute.c#L456-L560
https://github.com/libyal/libewf
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo