8.8

CVE-2021-3246: debian debian_linux Out-of-bounds Write

CVSS: 8.8v3.1HighModified
AliasesMGASA-2021-0392SUSE-SU-2021:14769-1RHSA-2021:3253
Published 20-07-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-3246 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 3.16% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
46/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
3.16%
0%100%
Low · -0.13 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 5
OPENSUSE-SU-2021:1166-1OPENSUSE-SU-2021:2764-1OPENSUSE-SU-2024:10992-1SUSE-SU-2021:2615-1SUSE-SU-2021:2764-1

Timeline

  1. 20-07-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

3.16%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

-0.13 pp

From 3.29% on 20-09-2026

20-09-202620-10-2026
EPSS score
3.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Libsndfile

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat6 products
  • libsndfile< 0:1.0.28-10.el8_4.1 | < 0:1.0.25-12.el7_9.1 | < 0:1.0.28-8.el8_1.1 | < 0:1.0.28-10.el8_2.1
  • libsndfile-debuginfo< 0:1.0.28-10.el8_4.1 | < 0:1.0.25-12.el7_9.1 | < 0:1.0.28-8.el8_1.1 | < 0:1.0.28-10.el8_2.1
  • libsndfile-debugsource< 0:1.0.28-10.el8_4.1 | < 0:1.0.28-8.el8_1.1 | < 0:1.0.28-10.el8_2.1
  • libsndfile-devel< 0:1.0.28-10.el8_4.1 | < 0:1.0.25-12.el7_9.1 | < 0:1.0.28-8.el8_1.1 | < 0:1.0.28-10.el8_2.1
  • libsndfile-utils< 0:1.0.25-12.el7_9.1
Debian2 products
  • libsndfile< 1.0.31-2 | < 1.0.28-6+deb10u1 | < 1.0.27-3+deb9u2
  • debian_linuxEOL9.0 | 10.0
Suse2 products
  • libsndfile&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 1.0.20-2.19.15.1
  • libsndfile&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 1.0.20-2.19.15.1
Fedoraproject1 product
Libsndfile_project1 product
Mageia1 product
  • libsndfile< 1.0.31-1.1.mga8
Ubuntu1 product
  • libsndfile< 1.0.28-4ubuntu0.18.04.2 | < 1.0.28-7ubuntu0.1 | < 1.0.25-7ubuntu2.2+esm2 | < 1.0.25-10ubuntu0.16.04.3+esm1

7 vendors · 14 products

References

29 links
Show all 29 references