CVE-2021-26635: bandisoft international inc. ark library Stack-based Buffer Overflow

Vulnerability summary

CVE-2021-26635 is a high (CVSS 7.8) Stack-based Buffer Overflow vulnerability in bandisoft international inc. ark library. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities.

Timeline

1. 01-06-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.