Heap Out-of-Bounds Read in libewf via Oversized EA Metadata

Executive Summary

This vulnerability is a heap out-of-bounds read in the libewf library affecting versions up to 20260924. It occurs when parsing UTF-16 extended attribute records in logical evidence files (.L01/.Lx01). The parser validates UTF-16 character counts before doubling them for byte length, but the validation uses the un-doubled count. This allows oversized sizes to pass checks, causing the read to exceed buffer bounds or leak uninitialized heap memory during extended attribute access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect files processed by libewf for .L01 or .Lx01 extensions. Use tools like ewfinfo or ewfmount to parse files and check for crashes or memory leaks during extended attribute parsing. Monitor application logs for heap out-of-bounds read errors when handling these files.

Useful 0 Not Useful 0

Impact Analysis

The impact includes application crashes when processing malicious .L01/.Lx01 files. It may also leak uninitialized heap memory through extended attributes, potentially exposing sensitive data. However, code execution or out-of-bounds writes have not been demonstrated. The vulnerability is reachable during file open with no additional API calls required.

Useful 0 Not Useful 0

Mitigation Strategies

Update libewf to the latest version beyond 20260924. Avoid opening untrusted .L01 or .Lx01 files until patched. If immediate patching is not possible, restrict access to libewf tools or disable extended attribute parsing in configurations.

Useful 0 Not Useful 0