CVE-2021-46879: treasuredata fluent_bit Out-of-bounds Write

Vulnerability summary

CVE-2021-46879 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in treasuredata fluent_bit. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-04-2023
   PublishedVulnerability first disclosed.
2. 11-02-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute arbitrary code on the target system.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.