In libewf through 20260924 an out‑of‑bounds heap read occurs in libewf_lef_extended_attribute_read_data() when the UTF‑16 name and value lengths are validated before being multiplied by two. The flaw enables an attacker who can supply a crafted .L01/.Lx01 file with inflated EA metadata counts to read beyond the allocated buffer, potentially causing a crash or exposing uninitialized heap data. The out‑of‑bounds read is a classic denial‑of‑service or information‑disclosure vulnerability (CWE‑125).

Affected product is the libyal.libewf library through version 20260924. The vulnerability is present in any build of libewf that has not been updated beyond that date. The library is commonly used in forensic tools that parse EnCase Evidence File formatted data, meaning any system that invokes libewf to process suspect evidence files is potentially affected.

The CVSS score of 6.9 indicates medium‑high risk, while the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in the CISA KEV catalog. It can only be triggered by supplying a maliciously crafted evidence file; no public network exposure is documented, so the attack vector is inferred to be local or dependent on a privileged file‑processing component. However, if the library is used within an exposed service, the attack could be remote. Overall, the threat is considered moderate, pending a security patch.