Vulnerability · Published Jun 1, 2022 · Assigned by krcert
CVE-2021-26635Bandisoft ARK Library buffer overflow vulnerability
High 7.8
In plain English
A high-severity stack buffer overflow in ark library from Bandisoft International Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.2%top 31.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bandisoft International Inc. | ark library | unspecified – through 7.17 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H