CVE-2021-34813: matrix olm Out-of-bounds Write
Vulnerability summary
CVE-2021-34813 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in matrix olm. EPSS estimates a 4.26% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 16-06-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.26%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (matrix.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- olm< 3.2.3~dfsg-3
Matrix1 product
- olm< 3.2.3
Ubuntu1 product
- olm< 3.1.3+dfsg-2ubuntu0.1~esm1
3 vendors · 3 products
References
7 links- matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolmX Refsource MISCREPORTExploitPatchVendor Advisory
- gitlab.matrix.org/matrix-org/olm/-/commit/ccc0d122ee1b4d5e5ca4ec1432086be17d5f901bX Refsource MISCREPORTPatchVendor Advisory
