Log in Start free

Vulnerability · Published Sep 1, 2022 · Assigned by redhat

CVE-2021-3826

Medium 6.5

In plain English

A medium-severity memory corruption in gcc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.5%top 25.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gdb10.2-11.el9ALSA-2023:6372
AlmaLinux:9gdb-doc10.2-11.el9ALSA-2023:6372
AlmaLinux:9gdb-gdbserver10.2-11.el9ALSA-2023:6372
AlmaLinux:9gdb-headless10.2-11.el9ALSA-2023:6372
AlmaLinux:9gdb-minimal10.2-11.el9ALSA-2023:6372
Debian:12binutils2.37.50.20220121-1DEBIAN-CVE-2021-3826
Debian:13binutils2.37.50.20220121-1DEBIAN-CVE-2021-3826
Debian:14binutils2.37.50.20220121-1DEBIAN-CVE-2021-3826
Debian:12libiberty20220713-1DEBIAN-CVE-2021-3826
Debian:13libiberty20220713-1DEBIAN-CVE-2021-3826
Debian:14libiberty20220713-1DEBIAN-CVE-2021-3826
Ubuntu:22.04:LTSgcc-11no fix listedUBUNTU-CVE-2021-3826
Ubuntu:24.04:LTSgcc-11no fix listedUBUNTU-CVE-2021-3826
Ubuntu:25.10gcc-11no fix listedUBUNTU-CVE-2021-3826
Ubuntu:26.04:LTSgcc-11no fix listedUBUNTU-CVE-2021-3826
Ubuntu:26.10gcc-11no fix listedUBUNTU-CVE-2021-3826
Ubuntu:22.04:LTSlibibertyno fix listedUBUNTU-CVE-2021-3826

Affected products (as reported)

VendorProductVersions
n/a gcc gcc 11.2.0

Weakness: CWE-119

References