libewf EUVD-2026-102286

Exploitation requires the target application to parse a crafted EWF logical-evidence file (.L01/.Lx01) using libewf, specifically reaching the extended-attribute ('ea') metadata path in libewf_lef_extended_attribute_read_data(), where UTF-16 name and value sizes are validated before being doubled. The limiting factors are significant: the attacker cannot reach the code remotely (AV:L) and must get a victim to open or process the malicious file (UI:P) - there is no automated or network-triggered path. No authentication is needed (PR:N), and default libewf behavior parses this metadata, so no special non-default configuration is required beyond the tool actually loading the attacker-controlled image. Realistic exposure is therefore limited to workflows that ingest untrusted or externally-supplied forensic images.

The CVSS 4.0 base score of 6.9 (Medium) is driven by local attack vector (AV:L), low complexity (AC:L), no privileges (PR:N) but required passive user interaction (UI:P), with impact concentrated in availability (VA:H, a crash) and only low confidentiality (VC:L, leak of uninitialized heap memory); integrity is unaffected. This is a file-parsing vulnerability, not a remotely reachable network flaw - exploitation requires a victim (typically a forensic analyst) to open or process an attacker-supplied .L01/.Lx01 evidence file, which meaningfully constrains real-world risk. Publicly available exploit code exists (hackmd write-up plus VulnCheck advisory), so the proof-of-concept signal is strong, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread opportunistic exploitation cannot be inferred. SSVC framing: exploitation is 'PoC', automatable is 'no' (requires per-victim file delivery and interaction), and technical impact is partial (crash/limited info leak rather than code execution). Net: this is a legitimate concern for digital-forensics practitioners who ingest untrusted evidence images, but it is a moderate, interaction-gated issue rather than a drop-everything internet-facing emergency. Note: the input provides only a CVSS 4.0 vector and no EPSS value - EPSS-based probability could not be weighed.

An attacker crafts a malicious EWF logical evidence file (.L01/.Lx01) whose extended-attribute ('ea') metadata declares oversized UTF-16 name/value counts, then delivers it to a forensic analyst (for example, as a planted or submitted 'evidence' image). When the analyst parses the file with a libewf-based tool, libewf_lef_extended_attribute_read_data() reads past the heap buffer, crashing the application or disclosing uninitialized heap memory. A public proof-of-concept and write-up already exist, lowering the barrier to reproduction.