CVE-2021-30496: telegram Stack-based Buffer Overflow

Vulnerability summary

CVE-2021-30496 is a medium (CVSS 5.7) Stack-based Buffer Overflow vulnerability in telegram. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-04-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).