CVE-2021-0674

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In alac decoder, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06064258; Issue ID: ALPS06064237.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-06757.8In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege CVE-2021-06764.4In geniezone driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosurCVE-2021-06774.4In ccu driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with SysteCVE-2021-06786.7In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SystCVE-2021-06796.7In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with SystemCVE-2021-06805.5In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disCVE-2021-06815.5In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disCVE-2021-06825.5In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permissioCVE-2021-06837.8In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could leCVE-2021-06847.8In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to localCVE-2021-06857.8In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserializatioCVE-2021-06865.5In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different devi
CVE-2021-0674: Medium severity, CVSS 5.5 | Vulnix