CVE-2025-70100

A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 filesystem image that results in a zero logical block size. The vulnerability is triggered during mount or image processing and leads to a Floating-Point Exception (FPE) under sanitizers or a runtime crash in standard builds due to missing validation of lb_size.

• CWE-369

• https://github.com/gkostka/lwext4/issues/90Exploit, Issue Tracking, Patch
• https://github.com/sigdevel/pocs/blob/main/res/lwext4/2/sig8_2_lwext4_ext4_blockdev_c_127Exploit
• https://infosec.exchange/@sigdevel/116668952003072580Exploit, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/06/29/5
• https://github.com/gkostka/lwext4/issues/90Exploit, Issue Tracking, Patch

Published

Jun 3, 2026

Last Modified

Jul 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-70092A cross-site scripting (XSS) vulnerability in the Item Kits …5.5
• CVE-2025-70093An issue in OpenSourcePOS v3.4.1 allows attackers to execute…7.4
• CVE-2025-70094A cross-site scripting (XSS) vulnerability in the Generate I…6.5
• CVE-2025-70095A cross-site scripting (XSS) vulnerability in the item manag…6.5
• CVE-2025-70099A NULL pointer dereference in the ext4_dir_en_get_name_len f…7.5
• CVE-2025-7010Stack overflow vulnerability due to uncontrolled recursion i…5.5
• CVE-2025-70101An out-of-bounds read in the ext4_ext_binsearch_idx function…6.5
• CVE-2025-70102A NULL pointer dereference occurs in Roy Marples NetworkConf…6.3
• CVE-2025-70103Heap buffer overflow vulnerability in libjxl 0.12.0 via craf…7.3
• CVE-2025-7011Heap out-of-bounds read vulnerability in Avast Antivirus whe…7.8
• CVE-2025-70116A NULL pointer dereference in GPAC MP4Box: when parsing cert…4.3
• CVE-2025-7012An issue in Cato Networks' CatoClient for Linux, before vers…8.6