CVE-2025-70101

An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by supplying a specially crafted ext4 filesystem image. The vulnerability occurs due to insufficient validation of extent header fields before performing a binary search over extent index entries, which can result in invalid pointer calculations and an out-of-bounds memory read during extent tree traversal.

• CWE-125

• https://github.com/gkostka/lwext4/issues/91Exploit, Issue Tracking, Patch
• https://github.com/sigdevel/pocs/blob/main/res/lwext4/3/sig11_lwext4_ext4_extent_815Exploit
• https://infosec.exchange/@sigdevel/116668958927817708Exploit, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/06/29/6
• https://github.com/gkostka/lwext4/issues/91Exploit, Issue Tracking, Patch

Published

Jun 3, 2026

Last Modified

Jul 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-70093An issue in OpenSourcePOS v3.4.1 allows attackers to execute…7.4
• CVE-2025-70094A cross-site scripting (XSS) vulnerability in the Generate I…6.5
• CVE-2025-70095A cross-site scripting (XSS) vulnerability in the item manag…6.5
• CVE-2025-70099A NULL pointer dereference in the ext4_dir_en_get_name_len f…7.5
• CVE-2025-7010Stack overflow vulnerability due to uncontrolled recursion i…5.5
• CVE-2025-70100A divide-by-zero vulnerability in the ext4_block_set_lb_size…5.5
• CVE-2025-70102A NULL pointer dereference occurs in Roy Marples NetworkConf…6.3
• CVE-2025-70103Heap buffer overflow vulnerability in libjxl 0.12.0 via craf…7.3
• CVE-2025-7011Heap out-of-bounds read vulnerability in Avast Antivirus whe…7.8
• CVE-2025-70116A NULL pointer dereference in GPAC MP4Box: when parsing cert…4.3
• CVE-2025-7012An issue in Cato Networks' CatoClient for Linux, before vers…8.6
• CVE-2025-70121An array index out of bounds vulnerability in the AMF compon…7.5