CVE-2021-4156

Katalog CVE

CVSS 7.1 · High EPSS 1,8%

Kerentanan Out-of-bounds Read pada libsndfile project libsndfile, debian linux. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.

Rincian

Terbit di NVD

23 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libsndfile/libsndfile/pull/732/commits/4c30646abf7834e406f7e2429c70bc254e18beab patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2027690 exploit · issue tracking · advisory pihak ketiga
• https://github.com/libsndfile/libsndfile/issues/731 exploit · issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00036.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202309-11
• https://lists.debian.org/debian-lts-announce/2025/12/msg00013.html