Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-70099: Lwext4 1.0.0 EXT4 Filesystem Image Denial of Service

CVE-2025-70099 · published 5 months ago

Summary

A specially crafted EXT4 filesystem image can cause a critical system failure if it's used with lwext4 1.0.0. This can happen when trying to access or manage files on the affected filesystem. To protect your system, update to a newer version of lwext4 that has this issue fixed.

Original advisory text

A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supplying a specially crafted EXT4 filesystem image with malformed directory entries. During directory iteration, the code may fail to validate the directory entry pointer before accessing the name_len field, resulting in a segmentation fault. This affects versions based on (or equivalent to) the 2016-era codebase (1.0.0).

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published1 Jun 2026

Updated4 Nov 2026

First seen1 Jun 2026

Sources

CVE-2025-70099 · NVD

Track software like this

Free during beta