CVE-2021-21772: Use After Free
A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21772?
CVE-2021-21772 is considered a critical vulnerability due to its potential for code execution from a specially crafted 3MF file.
How do I fix CVE-2021-21772?
To fix CVE-2021-21772, update to version 1.8.1+ds-3+deb10u1 or later of the lib3mf package.
Which software versions are affected by CVE-2021-21772?
Versions 2.0.0 of lib3mf and various Fedora 32, 33, and 34 distributions are affected by CVE-2021-21772.
Can CVE-2021-21772 be exploited remotely?
Yes, CVE-2021-21772 can be exploited remotely by providing a malicious 3MF file to an unsuspecting user.
What types of attacks can be conducted using CVE-2021-21772?
CVE-2021-21772 can be used to execute arbitrary code on the victim's machine through the use-after-free vulnerability.