Read the docs
TI-2026-74943 Aliases CVE-2026-111159

Heap out-of-bounds read in libewf L01 extended attribute parsing

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libewf through 20260924 from libyal contains a heap out-of-bounds read in libewf_lef_extended_attribute_read_data() (CWE-125). UTF-16 name and value sizes are validated before being doubled. A local attacker who gets a user to open a crafted .L01 or .Lx01 file with oversized ea metadata counts can crash the application or leak uninitialized heap memory through extended attributes. The references link an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libyallibewfup to 20260924—No fix listedCNA
  • libewf Vendorlibyal Affected up to 20260924 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libewf.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111159
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-26 CISA SSVC decision points changed
  6. 2026-10-26 Priority changed: LOW → MEDIUM

References

Exploit 1

Other 3

  • TI-2026-80946 Heap out-of-bounds read in libphdi extent data file path CVSS 4.0MEDIUM 6.9
  • TI-2026-80944 Heap out-of-bounds read in libpff table record parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74931 Heap out-of-bounds read in libyal libesedb multi-value handling CVSS 4.0MEDIUM 6.9
  • TI-2026-74924 Heap out-of-bounds read in libregf value data parsing CVSS 4.0MEDIUM 6.9
  • TI-2026-74919 libfwsi Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data CVSS 4.0MEDIUM 6.9
  • TI-2026-74918 Heap out-of-bounds read in libfwsi MTP file entry parsing CVSS 4.0MEDIUM 6.9
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences