CVE-2025-70099

Katalog CVE

CVSS 7.5 · High EPSS 0,38%

Kerentanan NULL Pointer Dereference. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supplying a specially crafted EXT4 filesystem image with malformed directory entries. During directory iteration, the code may fail to validate the directory entry pointer before accessing the name_len field, resulting in a segmentation fault. This affects versions based on (or equivalent to) the 2016-era codebase (1.0.0).

Rincian

Terbit di NVD

1 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/gkostka/lwext4/issues/89
• https://github.com/sigdevel/pocs/blob/main/res/lwext4/1/sig11_2_1_lwext4_ext4_dir_h_126
• https://infosec.exchange/@sigdevel/116668939725424227
• http://www.openwall.com/lists/oss-security/2026/06/29/4