CVE-2025-70100 — MEDIUM (5.5)

Vulnerability Description

A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 filesystem image that results in a zero logical block size. The vulnerability is triggered during mount or image processing and leads to a Floating-Point Exception (FPE) under sanitizers or a runtime crash in standard builds due to missing validation of lb_size.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Gkostka	Lwext4	1.0.0

Related Weaknesses (CWE)

CWE-369

References

https://github.com/gkostka/lwext4/issues/90ExploitIssue TrackingPatch
https://github.com/sigdevel/pocs/blob/main/res/lwext4/2/sig8_2_lwext4_ext4_blockExploit
https://infosec.exchange/@sigdevel/116668952003072580ExploitPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/29/5
https://github.com/gkostka/lwext4/issues/90ExploitIssue TrackingPatch

FAQ

What is CVE-2025-70100?

CVE-2025-70100 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 fil...

How severe is CVE-2025-70100?

CVE-2025-70100 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-70100?

Check the references section above for vendor advisories and patch information. Affected products include: Gkostka Lwext4.