CVE-2021-3520
9.8
CRITICAL · CVSS 3.1 · EPSS 3.2% (pctl 88)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.22% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-190 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-06-02 |
| Last modified | 2026-10-08 |
Affected (7)
| Vendor | Product |
|---|---|
| lz4 project | lz4 |
| netapp | active iq unified manager |
| netapp | cloud backup |
| netapp | ontap select deploy administration utility |
| oracle | communications cloud native core policy |
| oracle | zfs storage appliance kit |
| splunk | universal forwarder |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1954559
- https://security.netapp.com/advisory/ntap-20211104-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1954559
- https://security.netapp.com/advisory/ntap-20211104-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
→ the Explorer · watch your stack · NVD