CVE-2021-3517: debian debian_linux Out-of-bounds Write
Vulnerability summary
CVE-2021-3517 is a high (CVSS 8.6) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 16.99% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.
Severe, CVSS 8.6 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 17% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 14Timeline
- 19-05-2021PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- OSV · RubygemsEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- NVDNIST8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS trend
Probability
16.99%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 16.99% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp16 products
- active_iq_unified_managerna
- clustered_data_ontapna
- clustered_data_ontap_antivirus_connectorna
- e-series_santricity_os_controller≥ 11.0.0, ≤ 11.70.1
- e-series_santricity_storage_managerna
Oracle7 products
- communications_cloud_native_core_network_function_cloud_native_environment1.10.0
- enterprise_manager_base_platform13.4.0.0 | 13.5.0.0
- mysql_workbench≤ 8.0.26
- openjdk8:update301
- peoplesoft_enterprise_peopletools8.58
Alpine2 products
- libxml2< 2.9.9-r5 | < 2.9.10-r5 | < 2.9.10-r6 | < 2.9.10-r7 | < 2.9.11-r0
- qt5-qtwebengine< 5.15.3_git20211112-r0
Debian2 products
- libxml2< 2.9.10+dfsg-6.6
- debian_linuxEOL9.0
Redhat2 products
Fedoraproject1 product
- fedoraEOL33 | 34
RubyGems1 product
- nokogiri< 1.11.4
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm2 | < 2.9.3+dfsg1-1ubuntu0.7+esm1 | < 2.9.4+dfsg1-6.1ubuntu1.4 | < 2.9.10+dfsg-5ubuntu0.20.04.1
Xmlsoft1 product
- libxml2< 2.9.11
9 vendors · 33 products
References
32 links
lists.debian.org/debian-lts-announce/2021/05/msg00008.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- bugzilla.redhat.com/show_bug.cgi?id=1954232X Refsource MISCWEBIssue TrackingPatchThird Party Advisory
