CVE-2021-21811: att xmill Integer Underflow (Wrap or Wraparound)

Vulnerability summary

CVE-2021-21811 is a critical (CVSS 9.8) Integer Underflow (Wrap or Wraparound) vulnerability in att xmill. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-08-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.