An out-of-bounds read is triggered in the ext4_ext_binsearch_idx function of the lwext4 1.0.0 library when parsing an ext4 filesystem image. The vulnerability stems from insufficient validation of extent header fields before performing a binary search over extent index entries, which can cause invalid pointer calculations and a memory read outside the extent tree bounds. This overflow may crash the library and render any dependent application unusable, leading to a denial‑of‑service scenario.

The affected component is the lwext4 lightweight ext4 implementation, version 1.0.0, used in embedded and specialized systems that rely on external ext4 images. No vendor is listed in the CNA data, but any deployment that incorporates the open‑source library and accepts untrusted filesystem images is potentially vulnerable.

Exploitation requires an attacker to supply a crafted ext4 filesystem image and the vulnerable library to execute the faulty code path. There is no remote code execution or privilege escalation, but the crash can halt device functions or services. The EPSS score is unavailable and the issue is not listed in CISA KEV, indicating no widely cited exploitation yet. However, because the failure occurs in the core filesystem parser, the impact can be severe within affected environments, and the likelihood of exploitation is uncertain pending real‑world attack evidence.